I'm fairly new to PCI DSS and I'm confused over the requirement to perform pen-testing as per 11.3.4. as it states:-
Are penetration-testing procedures defined to test all segmentation methods, to confirm they are operational and effective, and isolate all out-of-scope systems from systems in the CDE?
We are a small business with a single card machine that takes payment by phone.
So the CDE is essentially the entire company as the card machine connects to the internet through the broadband router. We do have a DMZ with a single machine running on it for email access, but it has no ports open between the DMZ and internal network. In addition when we perform a network scan, I include the external IP's of the machine in the DMZ in addition to the IP's of the LAN.
Do I still need to pen-test our LAN from the DMZ as it seems to me, it's all already in scope of PCI DSS?