Does an automated penetration test count for SAQ D?

Many assessors accept automated penetration test reports, especially for simpler environments. If your assessor requires an engineer-led test, Clone Systems engineers can perform it.

What counts as a significant change?

Examples include new systems in the cardholder data environment, network changes, major application releases and new payment flows. When in doubt, ask your assessor.

Do I need segmentation testing?

Only if you use segmentation to reduce your PCI scope. If you do, it is required every 12 months and after changes to those controls.

How long does a penetration test take?

Automated tests can start the same day you buy them. Engineer-led tests are scheduled after a short scoping call.

Does SAQ D Require a Penetration Test? Yes. Here Is What 11.4 Asks

Does SAQ D require a penetration test?

PCI DSS v4.0.1. Last reviewed October 2026.

Yes. SAQ D merchants must complete internal and external penetration testing at least every 12 months and after any significant change, under PCI DSS v4.0.1 Requirement 11.4. If you use segmentation to reduce your PCI scope, those controls must be tested too.

What SAQ D asks for

Requirement	In plain language	How often
11.4.1	A documented testing methodology covering your whole cardholder data environment, its boundary, and both network and application layers	Kept current
11.4.2	Internal penetration test	Every 12 months and after significant changes
11.4.3	External penetration test	Every 12 months and after significant changes
11.4.4	Fix exploitable findings and retest to prove the fix	After each test
11.4.5	Test segmentation controls, if you use segmentation to reduce scope	Every 12 months and after changes

What your assessor or acquirer will look for

The methodology document.
Scope showing every system tested.
The report, with proof for each finding.
Evidence of retesting.
Segmentation test results, if segmentation is used.
Who performed the test and their qualifications.

How Clone Systems covers SAQ D

Automated external penetration test

From $1,995. Covers 11.4.3. Buy online and start the same day.

Automated internal penetration test

From $2,995 for 25 hosts. Covers 11.4.2.

Engineer-led penetration test

Covers all of 11.4, including segmentation testing, web applications, APIs and mobile apps, with a written report and free retest.

Retesting is included with every test, which covers 11.4.4.

Pairs with your quarterly ASV scan

Your SAQ D also requires passing quarterly external ASV scans (11.3.2) and internal vulnerability scans (11.3.1). Clone Systems runs both on the same platform as your penetration test, so scope is already known.

PCI ASV scanning.

Who runs your test

Clone Systems penetration testers hold CISSP, CMMC Certified Professional (CCP), API Penetration Testing (APIsec University), Hack The Box Dante Pro Lab, DevOps for Pentesters (Zero-Point Security), Practical Malware Analysis (TCM Security) and Targeted Malware Reverse Engineering (Kaspersky) credentials, and work alongside PCI ASV qualified staff. Every test is remote; we do not perform on-site testing.

A recent SAQ D engagement

A Pacific Northwest payment processing company, with web and mobile apps its business customers use to invoice, collect and send payments, validates PCI DSS with SAQ D for service providers. Clone Systems engineers tested the full platform remotely: the web application, the mobile apps, the APIs, and the external and internal networks. Every finding was written up for the assessor, with proof and a free retest of each fix. The assessor accepted the reports on the first submission.

One team for 11.3 and 11.4

Clone Systems has been a PCI Approved Scanning Vendor since 2007. The same team that runs your quarterly ASV scans runs penetration tests of every type for every SAQ, delivered remotely. Automated external tests start at $1,995 and can be bought online and started the same day. Engineer-led tests are scoped to your environment.