PCI DSS Pentesting Compliance Audit

I must obtain PCI DSS certification and need a full penetration-testing engagement that satisfies Requirement 11.3. This covers both external/internal network assets and customer-facing or internal web/mobile applications.

Scope
• Map the card-holder data environment, then execute comprehensive network and application tests (black-box and authenticated where applicable).
• Exploit, not just scan, to prove impact while maintaining evidence for auditors.
• Re-test once fixes are applied to confirm closure.

Deliverables
• Formal methodology and test plan aligned with PCI DSS 4.x.
• Detailed vulnerability report with risk ratings and reproducible PoCs.
• Executive summary for management and a technical appendix for engineers.
• Remediation recommendations prioritised by risk.
• Attestation of penetration test completion suitable for submission to my QSA.

I will grant VPN or on-site access, plus staging credentials for application testing. All testing must respect our change-control windows and be performed with Burp Suite, Nmap, Metasploit, or equivalent industry-standard tools. Data collected must remain confidential and deleted after sign-off.

Please indicate your testing framework, sample redacted reports, and estimated duration for initial test and follow-up verification.