Which PCI DSS requirement mandates regularly testing security systems and processes?

Which PCI DSS requirement mandates regularly testing security systems and processes?

• A. Requirement 6
• B. Requirement 9
• C. Requirement 11
• D. Requirement 12

Answer: (C)

Regular testing of security systems and processes keeps defenses effective as environments evolve. The requirement that focuses on this is the one that mandates ongoing testing of security controls, including activities like vulnerability scanning and penetration testing, as well as monitoring for changes to critical systems. By routinely probing for weaknesses and validating that controls work, organizations can identify and address gaps before attackers exploit them. This emphasis on testing and verification distinguishes it from other requirements: one set focuses on building secure software and systems, another on physical access controls, and another on governance, security policies, and incident response.

Regular testing of security systems and processes keeps defenses effective as environments evolve. The requirement that focuses on this is the one that mandates ongoing testing of security controls, including activities like vulnerability scanning and penetration testing, as well as monitoring for changes to critical systems. By routinely probing for weaknesses and validating that controls work, organizations can identify and address gaps before attackers exploit them. This emphasis on testing and verification distinguishes it from other requirements: one set focuses on building secure software and systems, another on physical access controls, and another on governance, security policies, and incident response.