When does the Payment Card Industry Data Security Standard (PCI-DSS) require organizations to perform external and internal penetration testing?

PCI-DSS does not require penetration testing twice a year as a baseline; the requirement is annually, not semi-annually.

PCI-DSS Requirement 11.3 explicitly states that penetration testing must be performed at least annually and after any significant changes to the network or applications, such as a new system component installation, network topology changes, or firewall rule modifications. The 'and' conjunction is critical - both conditions are required rather than either/or. This ensures ongoing validation of security controls over time and after change events.

A two-year cycle does not meet the PCI-DSS annual minimum penetration testing requirement defined in Requirement 11.3.

A three-year cycle significantly under-meets the PCI-DSS requirement and would place an organization out of compliance.