Why do service providers test segmentation every 6 months instead of 12?

Service providers handle card data for many businesses, so PCI DSS Requirement 11.4.6 asks them to confirm segmentation twice as often as merchants.

What does 11.4.7 mean for multi-tenant providers?

If customers share your environment, you must support their ability to run external penetration tests, for example with a documented process and timely access.

Does an automated penetration test count for a service provider?

Assessors usually expect engineer-led testing for service providers. Automated tests are useful for retesting after changes between engagements.

Can the whole test be done remotely?

Yes. Clone Systems performs every test remotely, including internal and segmentation testing, using a secure connection into your environment.

Does SAQ D for Service Providers Require a Penetration Test?

Does SAQ D for service providers require a penetration test?

PCI DSS v4.0.1. Last reviewed October 2026.

Yes. Service providers that validate with SAQ D must complete internal and external penetration testing at least every 12 months and after any significant change, and must test segmentation controls at least every 6 months under PCI DSS v4.0.1 Requirement 11.4. Multi-tenant providers must also support their customers' own testing.

What SAQ D for service providers asks for

Requirement	In plain language	How often
11.4.1	A documented testing methodology covering your whole cardholder data environment, its boundary, and both network and application layers	Kept current
11.4.2	Internal penetration test	Every 12 months and after significant changes
11.4.3	External penetration test	Every 12 months and after significant changes
11.4.4	Fix exploitable findings and retest to prove the fix	After each test
11.4.5	Test segmentation controls, if you use segmentation to reduce scope	Every 12 months and after changes
11.4.6	Service providers test segmentation controls more often	Every 6 months and after changes
11.4.7	Multi-tenant service providers support their customers' external penetration testing	Ongoing

What your assessor will look for

The methodology document.
Scope covering every system in the cardholder data environment, including APIs and customer-facing apps.
The report, with proof for each finding.
Evidence of retesting.
Segmentation test results from the last two 6-month cycles.
Who performed the test and their qualifications.

How Clone Systems covers SAQ D for service providers

Engineer-led penetration test

Covers all of 11.4: internal, external, web applications, mobile apps and APIs, with a written report and a free retest.

Segmentation testing every 6 months

Engineers test the controls that keep your cardholder data environment separate, on the schedule 11.4.6 requires.

Automated testing between engagements

Automated external tests from $1,995 and internal tests from $2,995 help you retest after changes without waiting for the next engagement.

Retesting is included with every test, which covers 11.4.4.

Pairs with your quarterly ASV scan

SAQ D also requires passing quarterly external ASV scans (11.3.2) and internal vulnerability scans (11.3.1). Clone Systems runs both on the same platform as your penetration test, so scope is already known.

PCI ASV scanning.

Who runs your test

Clone Systems penetration testers hold CISSP, CMMC Certified Professional (CCP), API Penetration Testing (APIsec University), Hack The Box Dante Pro Lab, DevOps for Pentesters (Zero-Point Security), Practical Malware Analysis (TCM Security) and Targeted Malware Reverse Engineering (Kaspersky) credentials, and work alongside PCI ASV qualified staff. Every test is remote; we do not perform on-site testing.

A recent SAQ D service provider engagement

A Pacific Northwest payment processing company, with web and mobile apps its business customers use to invoice, collect and send payments, validates PCI DSS with SAQ D for service providers. Their SAQ required internal and external penetration testing, a retest of every fix, and segmentation testing every six months. Clone Systems engineers tested the full platform remotely: the web application, the mobile apps, the APIs, and the external and internal networks. Every finding was written up for the assessor, with proof and a free retest of each fix. The assessor accepted the reports on the first submission.

One team for 11.3 and 11.4

Clone Systems has been a PCI Approved Scanning Vendor since 2007. The same team that runs your quarterly ASV scans runs penetration tests of every type for every SAQ, delivered remotely. Automated external tests start at $1,995 and can be bought online and started the same day. Engineer-led tests are scoped to your environment.