11.4.2—Internal penetration testing is performed: Per the entity’s defined methodology At least once every 12 months After any significant infrastructure or application upgrade or change By a qualified internal resource or qualified external third-party Organizational independence of the tester exists (not required to be a QSA or ASV).