Does SAQ C require an internal or external penetration test?

No. SAQ C only includes Requirement 11.4.5, the penetration test of segmentation controls. Many merchants still choose a full test to meet insurance, customer or acquirer expectations.

What if I do not use segmentation?

Then 11.4.5 does not apply. Without segmentation, your whole network is usually in scope, so check with your acquirer that SAQ C is still the right SAQ.

Who can perform the segmentation test?

A qualified internal resource or a qualified external third party with organizational independence. It does not have to be a QSA or ASV.

Can a segmentation test be done remotely?

Yes. Clone Systems performs segmentation testing remotely using a secure connection into your environment.

Does SAQ C Require a Penetration Test? Only for Segmentation

Does SAQ C require a penetration test?

PCI DSS v4.0.1. Last reviewed October 2026.

Only for segmentation. SAQ C does not require a full internal or external penetration test. If you use segmentation to keep your payment application system separate from the rest of your network, PCI DSS v4.0.1 Requirement 11.4.5 requires a penetration test of those segmentation controls at least every 12 months and after any change to them. SAQ C also requires quarterly internal vulnerability scans and quarterly ASV scans.

What SAQ C asks for in Requirement 11

Requirement	In plain language	How often
11.4.5	Penetration test of segmentation controls, if you use segmentation to reduce scope, by a qualified and independent tester	Every 12 months and after changes to segmentation
11.3.1	Internal vulnerability scans, with high-risk and critical findings fixed and rescanned	Every 3 months
11.3.2	External vulnerability scans by a PCI Approved Scanning Vendor, with a passing result	Every 3 months
11.3.2.1	External scans after any significant change	After significant changes
11.2.1	Check for authorized and unauthorized wireless access points	Every 3 months

What a segmentation test proves

Segmentation is what keeps the rest of your business network out of PCI scope. The test confirms, from the systems that should be out of scope, that they cannot reach the payment application system. If segmentation fails, your whole network can fall into scope, and SAQ C may no longer be the right questionnaire.

What your assessor or acquirer will look for

Results from the most recent segmentation test.
Proof that every segmentation method in use was tested.
Evidence that the tester was qualified and independent.
Four quarters of passing ASV scans.
Four quarters of internal scans with high-risk findings resolved.

How Clone Systems covers SAQ C

Segmentation penetration test

Clone Systems engineers test every segmentation control remotely and confirm your payment system is isolated, with a written report and free retest. Covers 11.4.5.

Internal vulnerability scanning

Quarterly internal scans with guided remediation, from $1,095 a year. Covers 11.3.1.

PCI ASV scanning

Quarterly external scans by an Approved Scanning Vendor since 2007, from $185 a year. Covers 11.3.2.

Who runs your test

Clone Systems penetration testers hold CISSP, CMMC Certified Professional (CCP), API Penetration Testing (APIsec University), Hack The Box Dante Pro Lab, DevOps for Pentesters (Zero-Point Security), Practical Malware Analysis (TCM Security) and Targeted Malware Reverse Engineering (Kaspersky) credentials, and work alongside PCI ASV qualified staff. Every test is remote; we do not perform on-site testing.

One team for 11.3 and 11.4

Clone Systems has been a PCI Approved Scanning Vendor since 2007. The same team that runs your quarterly ASV scans runs penetration tests of every type for every SAQ, delivered remotely. Automated external tests start at $1,995 and can be bought online and started the same day. Engineer-led tests are scoped to your environment.