Vulnerability Assessment
PCIComplianceHubLast updated
The broader process of identifying vulnerabilities, judging what each one actually means in the context of the environment, ranking them by risk and deciding what to do about them. A vulnerability scan is one input to this; the assessment is the analysis around it. The distinction matters under PCI DSS, which requires vulnerabilities to be given a risk ranking reflecting the environment they sit in rather than the raw score a scanner reports, and requires that ranking to be documented and justified.
Applies to. PCI DSS v4.0.1 does not use vulnerability assessment as a term, and the phrase is easy to confuse with the PCI DSS assessment, which is the compliance review that produces a ROC or SAQ. The work the term describes sits in Requirement 6, where newly identified vulnerabilities must be given a risk ranking that picks out at least those that are high-risk or critical, and in Requirement 11, where scan and penetration test findings are corrected according to the entity's assessment of the risk each one poses.
Related. Vulnerability, Risk Ranking, Vulnerability Scanning, Vulnerability Management, Risk Assessment
Sources. PCI DSS v4.0.1 (June 2024)