PCI DSS
Segmentation Testing
Check that systems handling card data are separated from the rest of your network. Get evidence to support your PCI DSS assessment.
Overview
Prove your CDE is isolated.
We test from out-of-scope networks toward your cardholder data environment, attempting to bypass the controls meant to isolate it. Deliverables are written to satisfy PCI DSS requirements 11.4.5 and 11.4.6, with remediation guidance and a free retest within 60 days.
Coverage
What we validate.
Evidence that scope-reducing segmentation controls are effective.
- CDE boundary & segmentation controls
- Out-of-scope to in-scope access attempts
- Firewall & ACL rule validation
- Network path & routing analysis
- Management & jump-host access
- Wireless & remote-access paths
- PCI DSS 11.4.5 / 11.4.6 evidence
- Remediation & rescope guidance
FAQ
PCI DSS segmentation testing FAQ
Scope, cost, and what happens next.
How much does PCI DSS segmentation testing cost?
Segmentation testing typically starts around €2,500 and depends on the number of network segments and connection points to the CDE. Use our estimator for a tailored figure.
How often is segmentation testing required under PCI DSS?
At least every 12 months for merchants, and every six months for service providers, plus after any significant change to segmentation controls.
What is the difference between segmentation testing and a full PCI penetration test?
Segmentation testing validates that out-of-scope networks cannot reach the CDE. A full PCI penetration test also tests the in-scope systems. Many clients need both.
Will the report satisfy our QSA?
Yes — reports are written to evidence PCI DSS requirements 11.4.5 and 11.4.6 and are designed to be handed straight to your QSA.
Do you also help with broader PCI DSS compliance?
Yes — see our PCI DSS compliance service for gap analysis, SAQ support, and remediation.
What do you need to scope segmentation testing?
A network diagram showing the CDE and surrounding segments, plus the segmentation controls in place. We test from out-of-scope toward the CDE.
More questions about this service
How does this differ from a PCI penetration test?
Segmentation testing proves isolation of the CDE; a full PCI penetration test also tests the in-scope systems. Requirement 11.4 expects both.
Will the report name the PCI requirements?
Yes — it is mapped to PCI DSS 11.4.5 and 11.4.6 so your QSA can use it directly.
How often do we need it?
At least annually for merchants and every six months for service providers, plus after segmentation changes.
Can you also help with full PCI compliance?
Yes — see our PCI DSS compliance service for gap analysis, SAQ/RoC support, and remediation.
Related services
Explore more.
Ready to validate your segmentation?
A 30-minute scoping call costs nothing. A failed PCI audit costs considerably more.
Book a short call Send an email