Risk Ranking
PCIComplianceHubLast updated
The severity an organization assigns to a vulnerability in its own environment, which determines how quickly the vulnerability must be fixed. PCI DSS requires vulnerabilities to be ranked, with those ranked critical or high remediated on a defined and short timeline and the remainder addressed according to their ranking. A CVSS score is an input, not the answer: the ranking must account for what the affected system does, where it sits relative to the cardholder data environment, and what other protections are in place. The method must be documented and applied consistently.
Applies to. 6.3.1 requires every entity to rank the vulnerabilities it identifies, in its own code and in third-party software, and to mark at least the ones that are high-risk or critical to its environment. The ranking then sets deadlines elsewhere: 6.3.3 gives critical patches one month and leaves the rest to the entity's own assessment, 11.3.1 requires high-risk and critical findings from internal scans to be resolved and rescanned, and 11.3.1.1 lets the remainder be handled on the timeline in the entity's targeted risk analysis.
Example. An online pharmacy receives a scanner report listing a medium-rated flaw in its content management system. Its documented ranking method asks whether the system is in the Cardholder Data Environment, whether it is internet-facing, and whether an exploit is public. The system is internet-facing but segmented from the payment systems, so the team ranks the flaw high rather than critical, records the reasoning, and schedules it for the next monthly patch cycle with the internal scan as the check.
Limits. Risk ranking is not a CVSS score, and it is not the targeted risk analysis under Requirement 12: the ranking classifies a vulnerability, the analysis justifies how often or how quickly a control is performed, and 11.3.1.1 uses both. The entity may set its own scale, but the scale has to say what counts as critical and high-risk, because those words trigger fixed obligations in 6.3.3 and 11.3.1. Ranking a finding low does not make it disappear; 11.3.1.1 still requires it to be addressed on a documented basis. And the ranking governs the entity's own environment only: an ASV's external scan uses the ASV Program Guide's thresholds, which the entity cannot override by ranking.