If segmentation isolates the CDE, penetration tests must be performed at least annually and after changes to segmentation controls to verify segmentation methods are operational and isolate out-of-scope systems.

If segmentation isolates the CDE, penetration tests must be performed at least annually and after changes to segmentation controls to verify segmentation methods are operational and isolate out-of-scope systems.

• A. Annual And After Changes
• B. Not Required
• C. Annual Only
• D. Never

Answer: (A)

Segmentation controls are used to limit the cardholder data environment and keep systems outside that environment from being affected. To trust that segmentation continues to work, you must verify it through hands-on testing. The required approach is to perform penetration testing of the segmentation controls at least once a year and again whenever you make changes to those controls. This ensures two things: you have a routine check that the isolation remains effective, and you catch any new misconfigurations or gaps introduced by changes before they can expose out-of-scope systems or expose the CDE. So the best choice reflects that both timing points are necessary: the annual test and a test after any changes to segmentation controls. The other options don’t fit because they miss either the regular cadence or the post-change validation, or imply no testing is needed at all.

Segmentation controls are used to limit the cardholder data environment and keep systems outside that environment from being affected. To trust that segmentation continues to work, you must verify it through hands-on testing. The required approach is to perform penetration testing of the segmentation controls at least once a year and again whenever you make changes to those controls. This ensures two things: you have a routine check that the isolation remains effective, and you catch any new misconfigurations or gaps introduced by changes before they can expose out-of-scope systems or expose the CDE.

So the best choice reflects that both timing points are necessary: the annual test and a test after any changes to segmentation controls. The other options don’t fit because they miss either the regular cadence or the post-change validation, or imply no testing is needed at all.