They also need to scan internally to protect against internal threats and compromised individuals. Internal testing should include controls between the various security zones (DMZ, cardholder data environment, SCADA environment, etc.) to ensure they are properly configured. The first factor that affects how often an organization should conduct a penetration test is its size. The…