3

As I understand the PCI DSS 3.0/3.1 penetration testing requirements, a company is compliant with 11.3 if the penetration test does not return any high risk vulnerabilities.

However, what happens if a low risk vulnerability identified during the penetration testing affects a requirement outside of 11.3? Is the company considered to be non-compliant?

For example, discovering an internal IP address is low risk from an external perspective, however this would affect compliance with 1.3.8, which states that private addresses must not be disclosed.

1 Answer 1

2

Yes, you are responsible for addressing any gaps that you are aware of. It does not matter how you became aware you had a 1.3.8 violation; you're responsible for remediating it. The fact that it doesn't meet the threshold for remediation under 11.3 is not relevant.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .