Scanning performed from outside the network against every internet-facing IP address and domain in scope, to find what an attacker on the internet could reach. PCI DSS requires it on two triggers with different rules, and conflating them is a common error. The quarterly scan under Requirement 11.3.2 must be performed by an Approved Scanning Vendor and must produce a passing result: under the ASV Program Guide a vulnerability with a CVSS base score of 4.0 or above normally fails the scan, so findings are remediated and the scan repeated until it passes. The scan after a significant change, under Requirement 11.3.2.1, resolves the same 4.0-and-above findings but may be run by qualified personnel with organizational independence from the systems scanned; it need not be an ASV or a QSA. Scope completeness is agreed between the scan customer and the ASV, and getting it right is the responsibility of the organization, not the vendor.
Applies to. Applies to any entity with system components reachable from the internet. For the routine scan, 11.3.2.a has the assessor examine ASV scan reports covering the most recent 12 months to confirm a scan at least once every three months, 11.3.2.b examines every scan and rescan report for resolved vulnerabilities and a passing result under the ASV Program Guide, and 11.3.2.c confirms the scans were run by a PCI SSC Approved Scanning Vendor. For the scan after a significant change, 11.3.2.1.a ties change control records to external scan reports, and 11.3.2.1.c confirms the tester, internal or external, was qualified and organisationally independent.
Example. An online retailer's ASV scans its public web servers, mail relay and remote-access gateway every quarter. The March scan reports a weak TLS configuration on the mail relay scored above 4.0; the team fixes it, requests a rescan and files the passing report. In June the retailer moves its storefront to a new hosting provider, and its own security engineer, who had no hand in the migration, scans the new addresses from outside before the next ASV cycle.
Limits. An external scan is not a penetration test: it finds known weaknesses from outside without attempting to exploit them, and 11.4.1 requires penetration testing separately. It is not an internal scan: 11.3.1 covers scanning inside the network on its own schedule and against the entity's own risk ranking rather than the ASV Program Guide. A passing ASV scan says nothing about addresses the ASV was not given, and a post-change scan run by internal staff under 11.3.2.1 does not count as one of the quarterly ASV scans under 11.3.2. Four passing scans in a year do not satisfy 11.3.2.a if any two are more than three months apart, and ASV status belongs to the vendor on the Council's published list, not to the scanning tool it uses.