What is a PCI compliance scan?

External scans and ASVs

The external half of Requirement 11.3 has to be performed by an Approved Scanning Vendor, a company the PCI Security Standards Council has qualified for the purpose. The ASV scans your internet-facing in-scope addresses, grades the findings, and issues a report. A scan with no vulnerability scored at or above the ASV threshold is a passing scan, and that is what satisfies the requirement. Your own scanning tool, however good, does not substitute for the ASV report.

Internal scans

Internal vulnerability scanning covers the systems inside your environment on the same cadence. It does not need an ASV: qualified internal staff or a third party can run it, as long as whoever runs it is organizationally independent of the systems being scanned. Version 4 also expects authenticated scanning where systems accept credentials, which finds a great deal that an unauthenticated scan from outside cannot see.

After significant change, not only on the calendar

A new internet-facing service, a change to the network topology, a new component in the cardholder data environment: each triggers a scan outside the quarterly rhythm. Teams that treat scanning as a quarterly ritual tend to fail this part, because the change that introduced the exposure happened in week two and nothing looked until week thirteen.

A scan is not a penetration test

Scanning is automated and looks for known vulnerabilities. Penetration testing, Requirement 11.4, is a human attempting to break in, at least once every 12 months, covering the perimeter and the segmentation that keeps the cardholder data environment separate. Service providers test segmentation more often than merchants do. Both are required, and one does not cover for the other.

What to do with the findings

Rank them, fix what the requirement obliges you to fix, and rescan or retest until the result is clean. Requirement 6.3.3 requires patches for critical vulnerabilities within one month of release; other security patches go in on a timeframe your own risk ranking sets. Keeping the scan reports and the remediation record is part of the evidence an assessor or an acquirer asks for.

Where Keel fits

Keel tracks scanning (11.3) and penetration testing (11.4) at that second level, as controls with owners and status, and the scan reports attach to them as evidence. The defined requirements beneath them, such as the separate internal and external scan duties, are not tracked one by one. Remediation of each finding can be tracked as a task with an assignee and a due date, linked to the control it belongs to. Keel does not perform scans and is not an ASV.

FAQ