PCI DSS 3.0: 11.3 - What happens if a low risk vulnerability prevents compliance with another requirement?

Question

As I understand the PCI DSS 3.0/3.1 penetration testing requirements, a company is compliant with 11.3 if the penetration test does not return any high risk vulnerabilities.

However, what happens if a low risk vulnerability identified during the penetration testing affects a requirement outside of 11.3? Is the company considered to be non-compliant?

For example, discovering an internal IP address is low risk from an external perspective, however this would affect compliance with 1.3.8, which states that private addresses must not be disclosed.

Answer 1

Yes, you are responsible for addressing any gaps that you are aware of. It does not matter how you became aware you had a 1.3.8 violation; you're responsible for remediating it. The fact that it doesn't meet the threshold for remediation under 11.3 is not relevant.