At least once a year, PCI compliance tests should be done, and every three months, vulnerability checks should be done. Testing security methods on a regular basis makes sure they are always up to date and that the business meets PCI DSS enforcement standards.