Infrastructure Security
SegmentationTesting.PCI DSS Req 11.4.5.
PCI DSS network segmentation testing checks whether controls isolate the cardholder data environment (CDE) from systems claimed to be out of scope. 443 Labs tests on-premises, cloud and hybrid boundaries and documents findings, remediation and retest results for assessor review.
CDE Isolation Testing · PCI DSS Req 11.4.5 · Scope Reduction
Testing Process
Segmentation Architecture Review
We review your network segmentation design — including firewall rules, VLAN configuration, routing policies, and micro-segmentation controls — to understand the intended isolation boundaries before testing.
Test Harness Design
Testing points are identified on both sides of each segmentation boundary. Test host placement and tool configurations are designed to simulate real-world lateral movement attempts from out-of-scope to in-scope network zones.
Boundary Penetration Testing
We actively attempt to traverse each segmentation boundary — testing firewall policies, VLAN hopping potential, routing exceptions, and any permitted pathways from out-of-scope to in-scope (CDE) network zones.
PCI DSS Report Delivery
A segmentation test report is produced for assessment evidence, documenting all tested boundaries, test methods, results, and a formal conclusion on the scope-reducing effectiveness of the segmentation controls.
Engagement Deliverables
Test your isolation controls.
Document the actual results.
Segmentation Test Executive Summary
Management overview of CDE isolation effectiveness, boundary test results, and scope validation conclusion.
Boundary Test Report
Detailed results per segmentation boundary with test methodology, tool output, and pass/fail determination for each boundary pair.
Breach Remediation Validation
Retest of any failed boundaries after remediation, confirming CDE isolation is restored before final sign-off.
Segmentation Assessment Evidence
A report documenting test scope, methods, findings, remediation and retest results for your assessor to review.
All segmentation boundaries tested — not just CDE perimeter
Active lateral movement attempts across every boundary pair
Cloud segmentation testing for AWS, Azure, and GCP environments
Documented scope, methods, isolation findings and retest evidence
Why 443 Labs
Segmentation evidence for assessor review.
Active Testing, Not Rule Review
Confirming segmentation through firewall rule review is not penetration testing — and it's not what PCI DSS requires. We actively attempt to traverse every boundary with real tools and techniques to produce defensible evidence.
Schedule Matched to Your Requirements
Requirement 11.4.5 calls for testing at least every 12 months; service providers have an additional six-month requirement under 11.4.6. Both require testing after changes to segmentation controls or methods. Our programme supports the agreed cadence, evidence tracking and assessment reporting.
Cloud Segmentation Testing Included
AWS Security Groups, Azure NSGs, and GCP VPC Firewall Rules are fully supported in scope. Hybrid and cloud-native CDE environments are tested using cloud-appropriate boundary testing methodologies.
Evidence Your Assessor Can Review
Reports document the boundaries tested, methods used and isolation results. Your assessor reviews this evidence alongside the wider PCI DSS assessment; report acceptance depends on the assessed environment and scope.
Not Sure Where to Start
We'll confirm your segmentation testing requirements and schedule your first test.
Share your network and payment-flow diagrams, proposed out-of-scope zones, segmentation rules, previous findings and recent changes. We will agree test locations, access, permitted techniques, the test window and retest coverage before work begins.
Segmentation Scope
Scope follows the isolation claims and controls in your environment. These are common test areas, not automatic exclusions: systems that connect to or can affect CDE security may remain in PCI DSS scope.
PCI DSS segmentation testing frequency
When segmentation is used to isolate the CDE, Requirement 11.4.5 sets a minimum interval of 12 months. Requirement 11.4.6 requires service providers to test at least every six months. Testing is also required after changes to segmentation controls or methods.
Confirm your assessment route and any additional requirements before setting the calendar. Use the current PCI SSC standard and assessment documents.
Prepare for a segmentation test
This service is useful when you rely on segmentation to reduce assessment scope, introduce a new cloud boundary or change an existing isolation control. Confirm which networks are claimed to be out of scope and how every segmentation method will be tested. A vulnerability scan or firewall rule review alone does not demonstrate effective segmentation.
The report should identify tested boundaries and test points, methods, dates, restrictions, observed access, findings and retest results. Your assessor uses it alongside the wider assessment evidence; a segmentation report alone does not establish PCI DSS compliance.
Use the readiness checklist and evidence register to assign evidence owners. For wider scope and reporting decisions, read the PCI DSS assessment guide. PCI SSC’s scoping and segmentation supplement explains the scoping principles; use it with the current standard.
Common Questions
What is network segmentation testing?
Network segmentation testing verifies that your firewall and network controls effectively isolate out-of-scope network zones from in-scope (CDE) zones. It is the technical proof that your PCI DSS scope reduction claims are valid.
When is segmentation testing required under PCI DSS?
When segmentation isolates the CDE from other networks, Requirement 11.4.5 requires testing at least every 12 months and after changes to segmentation controls or methods. Requirement 11.4.6 adds a six-month interval for service providers. Organisations using segmentation to reduce PCI DSS scope must ensure it is validated by penetration testing.
What does a failed segmentation test mean?
A failed segmentation test means that out-of-scope network zones can communicate with CDE systems — effectively expanding your PCI DSS scope to include those zones. Remediation is required before the scope reduction claim can be validated.
Can 443 Labs test cloud-based segmentation?
Yes. We test cloud-native segmentation controls — AWS Security Groups/NACLs, Azure NSGs, GCP VPC Firewall Rules — as part of PCI DSS segmentation testing for cloud-hosted CDE environments.
How often must segmentation testing be done?
The minimum interval is 12 months under Requirement 11.4.5 and six months for service providers under Requirement 11.4.6. Changes to segmentation controls or methods also trigger testing. Confirm any additional contractual requirements with your assessor or acquirer.
Also Explore
Related services
PCI DSS segmentation testing with documented boundaries, findings and retest evidence. Schedule your test.