Define the scope
Document systems, boundaries, roles, constraints, authorization, and deliverables.
Read nextPCI DSS
PCI penetration testing and ASV scanning are different.
Bring the applicable requirement, cardholder data environment context, and assessor guidance. We’ll define the penetration-testing scope without blurring it into ASV scanning.
Is a PCI DSS penetration test the same as an ASV scan?
No. PCI DSS penetration testing and external vulnerability scanning by a PCI SSC Approved Scanning Vendor are separate activities with different purposes, methods, and evidence. One should not be represented as a substitute for the other.
Confirm the requirements applicable to your organization with the appropriate PCI stakeholders. Trespass does not represent itself as providing ASV scanning through a penetration-testing engagement.
Primary references: PCI DSS, PCI SSC Approved Scanning Vendors
Define the environment
Start with the cardholder data environment and the controls that affect its boundary.
- External and internal networks
Identify in-scope network boundaries, exposed services, internal paths, and relevant environments.
- Applications and APIs
Map payment-related applications, application paths, supporting services, roles, and integrations.
- Segmentation
Where segmentation reduces scope, clarify the controls and the testing objective for validating that separation.
- Wireless
Identify applicable wireless technologies, locations, connections, and boundaries.
- Third parties
Clarify service-provider systems, ownership, permissions, responsibilities, and testing limitations.
What to send
Use the applicable requirement and assessor guidance as the starting point.
PCI environments can involve application, internal network, external network, segmentation, wireless, and service-provider considerations. The relevant combination must be established rather than assumed.
Bring the requirement
Provide the applicable PCI DSS language, assessment context, and any guidance from a Qualified Security Assessor, Internal Security Assessor, acquiring bank, or other relevant party.
Bring the architecture context
Describe the cardholder data environment, connected systems, segmentation controls, applications, networks, wireless elements, and third-party boundaries.
Bring the change context
Identify significant infrastructure or application changes and how they may affect the required scope or timing.
Bring the evidence expectation
Clarify who will review the output and what scope, methodology, findings, remediation, or retest details they expect.
Important distinction
A penetration test does not replace an ASV scan or PCI assessment.
A penetration test does not by itself establish PCI DSS compliance, replace an assessment, or produce an ASV scan.
- Trespass performs only the approved penetration-testing scope.
- ASV scanning must be handled separately through an Approved Scanning Vendor.
- System ownership, third-party authorization, Rules of Engagement, and stop conditions apply before testing.
- The assessor, acquiring entity, customer, or other requesting party decides whether it accepts the evidence.
Next step
Send the applicable PCI requirement and environment context.
Include non-sensitive assessor guidance, the systems that may be involved, and any known deadline. Trespass will identify the scoping questions that remain.