Free guide · PCI DSS v4.0.1

PCI DSS Requirement 11.3.2 — External ASV vulnerability scanning

Requirement 11.3.2 requires external vulnerability scans at least once every three months, performed by a PCI SSC Approved Scanning Vendor, with vulnerabilities resolved and rescans run until the ASV Program Guide criteria for a passing scan are met. Requirement 11.3.1 covers the internal equivalent.Timing: Applies in PCI DSS v4.0.1 and is assessed at every annual assessment.

Find your SAQ All guides

Who it applies to

Any entity with internet-facing systems in or connected to the cardholder data environment

SAQ A-EP, SAQ B-IP, SAQ C, SAQ D-Merchant and SAQ D for Service Providers

What Requirement 11.3.2 asks for

Paraphrased from PCI DSS v4.0.1. Read the standard itself for the authoritative wording and testing procedures.

External vulnerability scans are performed at least once every three months.

Scans are performed by a PCI SSC Approved Scanning Vendor (ASV).

Vulnerabilities are resolved and the ASV Program Guide requirements for a passing scan are met.

Rescans are performed as needed to confirm resolution.

Internal scans under Requirement 11.3.1 run on the same quarterly cycle and after significant changes.

Evidence an assessor expects

Four quarters of ASV scan reports with passing results

The scope statement listing every external IP and domain in scope

Remediation records and rescan evidence for failed findings

Attestations of scan completion signed by the ASV and the entity

Common mistakes

A scan scope that misses newly added external addresses or a secondary domain.

Treating a failed scan as complete because remediation was planned but not rescanned.

Using a non-ASV scanner for the external quarterly scans.

Not sure whether Requirement 11.3.2 is in your scope?

Which requirements you must answer depends on the SAQ that applies to your environment. The free SAQ selector walks the official PCI SSC decision flow, records every answer and re-derives the recommendation server-side with a confidence score.

Run the SAQ selector Talk to a QSA

Paraphrased from PCI DSS v4.0.1 (PCI Security Standards Council). Independent summary; not endorsed by PCI SSC. Refer to the PCI SSC Document Library for the authoritative standard.