Port Scanning

Applies to. PCI DSS v4.0.1 does not name port scanning in its requirements. It is a technique inside the scans and tests the standard does require rather than a requirement of its own: the penetration testing methodology must include network-layer tests covering all components that support network functions and operating systems, and Requirement 1 limits inbound traffic from untrusted networks to authorised services, protocols and ports, which is what a scan from outside checks.

Limits. A port scan on its own is not a vulnerability scan or a penetration test; it finds open ports, and the standard's tests go on to identify vulnerabilities and assess whether they can be exploited.