Security testing requirements that apply to an organization are fully determined by your assessment status. All organizations consider some form of penetration testing, but you would not be required if you fall into any of the following Self Assessment questionnaires(SAQs):
SAQ A: For merchants that outsource their entire card data processing to validated third parties. This includes e-commerce merchants and mail/telephone order merchants.
SAQ B: For e-commerce merchants that don’t receive cardholder data but do control the method through which data is redirected to a third-party payment processor.
SAQ B-IP: For merchants that don’t store cardholder data in electronic form but use IP-connected point-of-interaction devices. These merchants may handle either card-present or card-not-present transactions.
SAQ C-VT: For merchants that process cardholder data via a virtual payment terminal rather than a computer system. A virtual terminal provides web-based access to a third party that hosts the virtual terminal payment-processing function.
SAQ P2PE: For merchants that use point-to-point encryption. It’s therefore not applicable to organizations that deal in e-commerce.