PCI Penetration testing should be performed at least once annually or after a significant upgrade or changes to the segmentation controls.