PCI DSS ASV Scans: Quarterly External Scan Requirements and How to Pass

What 11.3.2 Requires

• External vulnerability scans at least once every three months
• Completed by a PCI SSC Approved Scanning Vendor
• Vulnerabilities resolved and ASV Program Guide requirements for a passing scan met (examine scans and rescans from the last 12 months)
• Not eligible for the customized approach
• Initial assessment note: four passing scans in 12 months are not required if the assessor verifies the most recent scan is passing, documented quarterly policy exists, and vulnerabilities are corrected as shown in results - then maintain quarterly thereafter

After Significant Change (11.3.2.1)

External vulnerability scans are also performed after any significant change, covering affected system components as specified in the requirement.

How to Pass (ASV Program Guide)

• With limited exceptions, any vulnerability with CVSS Base Score 4.0 or higher yields a non-compliant component/scan - remediate and rescan until passing
• Certain findings are automatic failures (for example SQL injection, XSS, directory traversal, presence of certain malware/backdoors, and default accounts/passwords as specified in the guide)
• Pure denial-of-service style issues (per the guide) must not be ranked as failures
• Confirm current ASV Program Guide details with your ASV

SAQ A Callout

For PCI DSS v4.x, ASV requirements were added to SAQ A for e-commerce systems hosting redirect or embedded TPSP payment pages - see the PCI SSC ASV Resource Guide (July 2024) and the SAQ A guide.

Scope Practice

The scan customer confirms in-scope IPs and domains. The ASV performs discovery and lists additional components identified. A dispute and false-positive process exists for contested findings.

How CyberSilo Helps

• TEM plus remediation tracking aligned to ASV findings
• ThreatHawk SIEM correlation of exploit attempts
• Evidence retention of four quarterly pass reports for assessors

Frequently Asked Questions

What score fails an ASV scan?

Generally a CVSS Base score of 4.0 or higher, plus listed automatic failures - then rescan until you pass.

Do I need four passing scans before my first ROC?

An initial assessment may accept fewer if the latest scan is passing and policy and remediation evidence exist; thereafter maintain quarterly passing scans.

Can any vulnerability scanner brand be used?

For 11.3.2 compliance attestation, the scanner must be a PCI SSC-listed ASV using an approved ASV scan solution.

Related PCI Resources

Requirement 11 · QSA vs ISA vs ASV · Segmentation testing · SAQ A · PCI hub