When does the Payment Card Industry Data Security Standard (PCI-DSS) require organizations to perform external and internal penetration testing?

PCI-DSS requires penetration testing at minimum annually, not twice a year - the twice-yearly frequency is not a PCI-DSS requirement for penetration testing.

PCI-DSS Requirement 11.3 specifies that organizations must perform external and internal penetration testing at least once every 12 months and after any significant upgrade or modification to the network infrastructure or applications. This annual cadence, combined with change-triggered testing, ensures that new vulnerabilities introduced by changes are identified before they can be exploited.

A two-year cycle would violate PCI-DSS Requirement 11.3, which explicitly mandates at least annual penetration testing to maintain compliance.

A three-year cycle is far outside the PCI-DSS requirement and would leave cardholder data environments unvalidated for unacceptably long periods between assessments.