When does the Payment Card Industry Data Security Standard (PCI-DSS) require organizations to perform external and internal penetration testing?

PCI DSS Requirement 11.3 states that organizations must implement a penetration testing methodology and conduct penetration tests at least annually and after any significant infrastructure or application changes. This annual cadence ensures that new vulnerabilities introduced over time or via changes are identified before attackers can exploit them. The 'after significant change' clause ensures that newly deployed systems or modified architectures do not introduce untested attack surfaces.

A three-year interval is not aligned with PCI DSS requirements and would leave too large a window for undetected vulnerabilities to persist.

Twice per year exceeds the minimum PCI DSS mandate, which is at least once annually, not twice - this option misrepresents the standard's actual requirement.

A two-year interval does not meet the PCI DSS annual minimum penetration testing requirement specified in Requirement 11.3.