PCI DSS Penetration Testing in Australia: Requirement 11.4, SAQ Types and Costs

PCI DSS penetration testing is mandatory for Australian businesses whose PCI DSS validation includes Requirement 11.4: every merchant or service provider assessed through a Report on Compliance, plus anyone completing SAQ D or SAQ A-EP. Under PCI DSS v4.0.1 you need external (and, for SAQ D and ROC, internal) penetration tests at least once every 12 months and after any significant change, a retest of exploitable findings, and segmentation testing if you use segmentation to shrink scope. Merchants on SAQ A, B, C-VT or P2PE don't have a pentest line in their questionnaire, though their acquirer or customers can still ask for one. At Aussie Pentest, human-led penetration testing starts from $5,000 + GST.

This guide explains which Australian businesses need a PCI pentest, what Requirement 11.4 actually asks for, how it differs from the quarterly ASV scan, how to scope it, what it costs, and how it fits with the Privacy Act. If you just want the difference between scanning and testing first, read vulnerability assessment vs penetration testing.

Who needs PCI DSS penetration testing in Australia?

Any Australian business that stores, processes or transmits payment card data must comply with PCI DSS, but whether a formal penetration test is required depends on how you validate. Your acquiring bank or payment provider tells you your merchant level and which validation document you need. That document decides whether Requirement 11.4 applies.

PCI DSS isn't Australian law. It's a contractual standard set by the PCI Security Standards Council (PCI SSC) and enforced by the card schemes through acquirers. Visa states that PCI DSS compliance is required of all entities that store, process or transmit Visa cardholder data, and that acquirers must make sure their merchants validate at the right level.

Merchant levels in Australia

Australian acquirers publish their own level tables. In Westpac's PCI DSS guide, for example, Level 1 merchants (more than 6 million Visa or Mastercard transactions a year) need an annual Report on Compliance (ROC) from a PCI-approved Qualified Security Assessor (QSA). Levels 2 to 4 generally complete an annual Self-Assessment Questionnaire (SAQ) plus quarterly scans by an Approved Scanning Vendor (ASV). Card schemes count volume separately and Visa has consolidated its own tiers, so confirm your level with your acquirer.

Which SAQ types include a penetration test?

This is where most confusion sits. Under PCI DSS v4.0.1:

▸Report on Compliance (ROC): all of Requirement 11.4 that applies to your environment, internal and external
▸SAQ D (merchants and service providers): the full Requirement 11.4, including internal and external testing, retesting and segmentation testing. Service providers test segmentation every six months
▸SAQ A-EP: a documented methodology, an external penetration test, retesting and segmentation testing if used. No internal test line
▸SAQ B-IP and SAQ C: segmentation testing only, and only if segmentation is what keeps the rest of your network out of scope
▸SAQ A, B, C-VT and P2PE: no penetration testing requirement in the questionnaire

The SAQ A versus SAQ A-EP line matters most for online stores. If your checkout fully redirects to your payment provider or uses the provider's embedded form, and every element of the payment page comes from that provider, you're usually SAQ A. If your own site serves part of the payment page or posts card data straight to the provider, you're usually SAQ A-EP, which brings in an external pentest that, in practice, needs to cover your website at the application layer. In January 2025 PCI SSC revised SAQ A, removing requirements 6.4.3 and 11.6.1 and adding an eligibility criterion that merchants confirm their site isn't susceptible to script attacks affecting their e-commerce systems.

What does PCI DSS Requirement 11.4 actually require?

Requirement 11.4 says external and internal penetration testing is performed regularly, and exploitable vulnerabilities and security weaknesses are corrected. It breaks into seven sub-requirements, and assessors check each one separately.

11.4.1 Methodology: a defined, documented penetration testing methodology using industry-accepted approaches. It must cover the entire cardholder data environment (CDE) perimeter and critical systems, test from inside and outside the network, validate segmentation and scope-reduction controls, include application-layer testing for at least the vulnerabilities in Requirement 6.2.4, include network-layer testing, consider threats and vulnerabilities from the last 12 months, and document how exploitable findings are assessed and addressed
11.4.2 Internal testing: at least once every 12 months and after any significant infrastructure or application upgrade or change
11.4.3 External testing: the same cadence, from outside the network
11.4.4 Remediation and retest: exploitable vulnerabilities and security weaknesses are corrected in line with your risk assessment, and testing is repeated to verify the fixes
11.4.5 Segmentation testing: if you use segmentation to isolate the CDE, test all segmentation controls at least once every 12 months and after changes, confirming they isolate the CDE from all out-of-scope systems
11.4.6 Service providers only: segmentation testing at least once every six months and after changes
11.4.7 Multi-tenant service providers: support customers' external penetration testing, by providing evidence or access

Who is allowed to do the test?

For 11.4.2, 11.4.3 and 11.4.5, the standard requires a qualified internal resource or a qualified external third party, with organisational independence of the tester. The tester doesn't have to be a QSA or an ASV. Independence is the bit that trips up smaller businesses: the person or MSP who built and runs your firewall usually can't credibly test it. That's one reason many Australian businesses bring in an outside tester to validate what their MSP built, rather than replace the MSP.

What counts as "every 12 months" and "significant change"?

PCI DSS v4.0.1 defines every 12 months as at least once every 365 days (366 in a leap year), or on the same date each year. Testing in January one year and December the next fails the interval. "Significant change" is defined by you, so your methodology should say what triggers a new test, for example a new payment flow, a migration to a new cloud provider, a firewall replacement or a major application release.

The v4.0 transition is finished

PCI DSS v3.2.1 was retired on 31 March 2024, and v4.0 was retired on 31 December 2024, leaving v4.0.1 as the only active version. The 51 future-dated requirements introduced in v4.0 became mandatory from 31 March 2025. If your last pentest scope was written against v3.2.1 language (the old Requirement 11.3), it's worth refreshing your methodology before the next assessment.

Is an ASV scan the same as a PCI penetration test?

No. Quarterly ASV scans are Requirement 11.3.2; penetration testing is Requirement 11.4. Passing one doesn't satisfy the other. A scan ranks known vulnerabilities automatically; a pentest has a person exploit and chain weaknesses, including business logic flaws scanners miss.

▸Internal vulnerability scans (11.3.1): at least once every three months, by qualified personnel
▸External ASV scans (11.3.2): at least once every three months, by a PCI SSC Approved Scanning Vendor, with rescans until you get a passing result
▸Penetration tests (11.4): at least once every 12 months and after significant change, by a qualified, independent tester

Aussie Pentest is not an ASV, so our services don't replace your quarterly ASV scan. Our automated security assessment ($80 to $2,000 AUD, analyst-reviewed) is useful for checking your web exposure between tests, but it is not an ASV scan and it is not a penetration test, and we don't sell it as either.

How do you scope a PCI DSS penetration test?

Start from your CDE and the systems that can affect it, then work outwards. A good scope is driven by your cardholder data flow diagram, not a list of IP addresses someone found in a spreadsheet.

What to have ready before scoping

▸Your validation type: SAQ A-EP, SAQ D or ROC, and whether you're a merchant or service provider
▸A current data flow diagram: where card data enters, moves, is stored and leaves
▸Network diagrams and segmentation design: firewalls, VLANs, cloud security groups and any isolation you rely on to reduce scope
▸Last year's report and remediation records: so the new test checks that old findings stayed fixed

Typical PCI pentest scope areas

▸External network: internet-facing IPs, VPNs and exposed services on the CDE perimeter
▸Web applications and payment pages: injection, broken authentication and access control, and script tampering risks on checkout pages. See our guide to web application penetration testing
▸APIs: payment, order and customer APIs that touch card data or tokens
▸Internal network: lateral movement and privilege escalation towards CDE systems (required for SAQ D and ROC). See external vs internal penetration testing
▸Segmentation: attempts from each out-of-scope network to reach the CDE, proving the walls actually hold
▸Cloud: misconfigured security groups, over-privileged identities and exposed secrets in AWS, Azure or GCP. See cloud penetration testing in Australia

Common PCI pentest gaps

▸Segmentation assumed, not tested: the network diagram says the CDE is isolated, but nobody has tried to reach it from the corporate Wi-Fi or a staff laptop
▸Only the IPs, not the app: an external test that scans the perimeter but never tests the checkout application, which is where e-commerce attacks happen
▸No retest evidence: findings were fixed, but there's no report proving it, so 11.4.4 can't be demonstrated
▸Stale scope: a re-platformed online store or new cloud environment that never made it into the test
▸Interval drift: the annual test slips a few weeks each year until it breaches the 12-month window

Want a second opinion on your scope before your assessment? Book a 1-on-1 call and we'll walk through it with you.

How much does PCI DSS penetration testing cost in Australia?

At Aussie Pentest, fixed-fee human-led penetration tests start from $5,000 + GST, and most PCI scopes land in the Basic or Standard tier depending on whether you need internal testing. Price is driven by the number of IPs, applications, APIs and network segments in scope, not by the PCI label itself.

▸Basic, from $5,000 + GST: external network penetration test, up to 25 IP addresses, suited to small web apps. Often a fit for SAQ A-EP merchants who need an external test covering their website
▸Standard, from $12,000 + GST: external and internal network penetration test, up to 50 IPs and 2 to 3 web applications, executive summary and debrief. Often a fit for SAQ D merchants who need internal, external and segmentation testing
▸Advanced, from $20,000 + GST: full-scale testing across external and internal networks, web applications, APIs and social engineering. Suited to service providers and larger, more complex environments

All tiers include a written scope document, a severity-ranked report and proof-of-concept evidence on every critical finding, and engagements are typically delivered in 5 to 10 business days. Retest confirmation is included, which gives you documented evidence for 11.4.4. International clients are GST-free. Full details are on our pricing page, and our penetration testing costs guide explains what drives price up or down.

Why does PCI pentesting matter beyond the checkbox?

Card data attacks are still a real cost for Australian businesses, and a passing SAQ doesn't stop them. Testing is how you find out whether your controls actually hold before an attacker does.

▸AusPayNet reported $854 million in fraud on Australian payment cards in the 12 months to 30 June 2025, with card-not-present fraud on Australian cards used domestically at $312 million
▸The OAIC received 1,205 data breach notifications in calendar year 2025, the highest since the Notifiable Data Breaches scheme began in 2018, with 716 attributed to malicious or criminal activity
▸ASD's Annual Cyber Threat Report 2024–25 put the average self-reported cost of cybercrime per report at $56,600 for small businesses and $97,200 for medium businesses

How does PCI DSS fit with the Privacy Act, Essential Eight and other frameworks?

One well-scoped pentest can support several obligations at once, as long as the scope covers the systems each one cares about.

▸Privacy Act and APP 11: card data linked to an individual is personal information. APP 11 requires reasonable steps to protect it, and a breach likely to cause serious harm triggers the Notifiable Data Breaches scheme. See our guide to Privacy Act cyber security requirements
▸Essential Eight: patching, MFA and admin privilege controls reduce the attack paths a PCI pentest will try. Our Essential Eight assessment is $4,950 + GST for environments up to 50 seats
▸ISO 27001 and SOC 2: if you're also certifying, align test scope so one report serves all assessors. See ISO 27001 penetration testing in Australia
▸APRA CPS 234: APRA-regulated entities and their suppliers often face PCI and CPS 234 testing expectations together. See CPS 234 penetration testing

If you need someone to own the PCI calendar, track findings and keep the 12-month and six-month windows from slipping, a vCISO retainer ($2,500 to $6,500 a month) provides advisory and oversight. It isn't implementation or incident response. MSPs supporting merchant clients can deliver testing under their own brand through our white-label program.

How do you prepare for a PCI DSS penetration test?

Lock the scope early, give the testers what they need, and leave time to fix and retest before your assessment.

Confirm your SAQ type or ROC requirements with your acquirer or QSA
Update your cardholder data flow and network diagrams
Write or refresh your penetration testing methodology so it covers every 11.4.1 element
Agree rules of engagement, testing windows and emergency contacts in writing
Provide test accounts for each user role on payment and admin applications
Book the test at least six to eight weeks before your assessment so there's time to remediate and retest
Log findings in your risk register with owners and due dates

For a fuller checklist, see how to prepare for a penetration testing engagement.

Frequently asked questions

Does a small online store need a PCI penetration test?

Only if its validation document includes Requirement 11.4. A small store on SAQ A, using a full redirect or the provider's embedded form, has no pentest line. If your site serves part of the payment page, you're likely SAQ A-EP, which requires an external penetration test. Confirm with your payment provider.

Do we have to fix every finding before our assessment?

You must correct exploitable vulnerabilities and security weaknesses in line with your risk assessment and retest to confirm the fixes, under Requirement 11.4.4. In practice, critical and high findings in or near the CDE should be fixed and retested before your QSA or SAQ deadline.

Will a PCI pentest guarantee we pass our assessment?

No. A penetration test supplies evidence for Requirement 11.4, but your QSA, acquirer or the card schemes decide whether you're compliant. Passing also depends on the rest of PCI DSS, from access control to logging and policy.

Bottom line

PCI DSS penetration testing is required if your validation includes Requirement 11.4, which means every ROC, SAQ D and SAQ A-EP, plus segmentation testing for SAQ B-IP and C merchants who rely on segmentation. Test at least every 12 months and after significant change, use an independent tester, fix and retest exploitable findings, and keep your quarterly ASV scans separate. Aussie Pentest engagements start from $5,000 + GST, with fixed fees, written scope and retest confirmation included.

Ready to scope your PCI test? Book a 1-on-1 call, or review our penetration testing services and pricing.

Sources

This article is general information only, not legal, audit or compliance advice. Aussie Pentest is not a PCI Qualified Security Assessor (QSA) or Approved Scanning Vendor (ASV), and a penetration test supports your PCI DSS evidence but doesn't guarantee an assessment outcome. Your acquirer, QSA or the card schemes decide your validation requirements. Prices are current as of October 2026, and statistics and standards references were checked in October 2026. Only test systems you have written authority to assess.