As I understand the PCI DSS 3.0/3.1 penetration testing requirements, a company is compliant with 11.3 if the penetration test does not return any high risk vulnerabilities.

However, what happens if a low risk vulnerability identified during the penetration testing affects a requirement outside of 11.3? Is the company considered to be non-compliant?

For example, discovering an internal IP address is low risk from an external perspective, however this would affect compliance with 1.3.8, which states that private addresses must not be disclosed.

1 Answer 1


Yes, you are responsible for addressing any gaps that you are aware of. It does not matter how you became aware you had a 1.3.8 violation; you're responsible for remediating it. The fact that it doesn't meet the threshold for remediation under 11.3 is not relevant.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .