Internal Vulnerability Scanning
PCIComplianceHubLast updated
Scanning performed from inside the network to identify vulnerabilities on system components in and connected to the cardholder data environment. PCI DSS requires it at least once every three months and after any significant change, with high-risk and critical findings resolved and rescans performed to confirm the fix. Unlike external scanning it does not require an Approved Scanning Vendor and may be run by qualified internal staff, provided they are organizationally independent of the systems being scanned. Under v4.x these scans must also be authenticated.
Applies to. Requirement 11 asks for internal scans of the system components in and connected to the CDE at least once every three months and after any significant change, run by qualified personnel with organisational independence from the systems scanned, and authenticated, with credentials that give the scanner enough privilege to see what is installed on the host. High-risk and critical findings, as ranked under the entity's Requirement 6 process, must be resolved and a rescan run to confirm.
Limits. No ASV is needed for internal scans; the ASV requirement belongs to the external quarterly scan. The authenticated-scanning rule applies to internal scans only.
Related. Authenticated Internal Vulnerability Scan, External Vulnerability Scanning, Vulnerability Scanning, Risk Ranking, Organizational Independence
Sources. PCI DSS v4.0.1 (June 2024)