Vulnerability Scanning
PCIComplianceHubLast updated
The use of automated tools to check systems and networks against a database of known vulnerabilities and misconfigurations. PCI DSS requires two distinct kinds on different terms: external scanning, which must be performed by an Approved Scanning Vendor, and internal scanning, which may be performed by qualified staff and, under v4.x, must be authenticated. Both are required at least once every three months and after any significant change, and both require findings to be remediated and a rescan performed to confirm the fix. A scan that was run but never passed does not satisfy the requirement.
Applies to. Requirement 11 is where PCI DSS v4.0.1 asks for scanning, on two tracks. External scans of internet-facing addresses must be run by an Approved Scanning Vendor and pass; internal scans of in-scope system components may be run by qualified personnel with organisational independence and must be authenticated; both run at least once every three months and after any significant change, with findings resolved and a rescan run to confirm. Internal scan results are judged against the entity's Requirement 6 risk ranking, which decides which findings must be fixed.
Limits. A scan is not a penetration test: Requirement 11 asks for both, scans at least every three months and penetration tests at least every 12 months.