How do I know if my organization is required to perform PCI DSS penetration testing?

If your organization stores, processes, or transmits payment card data, or can impact the security of the Cardholder Data Environment, PCI DSS requires penetration testing as part of compliance validation. This includes merchants, service providers, and organizations that rely on segmentation to isolate cardholder data systems.