Penetration testing results and remediation activities must be retained.

Penetration testing results and remediation activities must be retained.

• A. Not Retained
• B. Retained Indefinitely
• C. Retained For 6 Months
• D. Retained

Answer: (D)

Documentation and retention of penetration testing results and the remediation actions that follow are essential for proving security testing was actually performed and that fixes were implemented and verified. Keeping these records creates an auditable trail that auditors can review to confirm compliance with PCI DSS requirements and to demonstrate that the organization tracks and closes vulnerabilities. It also supports ongoing risk management by enabling trend analysis, repeat testing, and verification that remediation remains effective over time. If these records aren’t retained, there’s no verifiable evidence that testing occurred or that remediation was completed and validated, which undermines compliance and makes future assessments harder. A policy typically defines how long to keep these documents, but the practice is to retain them because they are part of the accountability and continuous improvement of the security program.

Documentation and retention of penetration testing results and the remediation actions that follow are essential for proving security testing was actually performed and that fixes were implemented and verified. Keeping these records creates an auditable trail that auditors can review to confirm compliance with PCI DSS requirements and to demonstrate that the organization tracks and closes vulnerabilities. It also supports ongoing risk management by enabling trend analysis, repeat testing, and verification that remediation remains effective over time.

If these records aren’t retained, there’s no verifiable evidence that testing occurred or that remediation was completed and validated, which undermines compliance and makes future assessments harder. A policy typically defines how long to keep these documents, but the practice is to retain them because they are part of the accountability and continuous improvement of the security program.