Compliance
How often should you run vulnerability scans? PCI DSS, HIPAA, CIS and insurance
Quarterly is the compliance floor, monthly is the practical baseline. What PCI DSS, HIPAA, CIS Controls and cyber insurers expect, and how to set a scan cadence per client.
Varaxon Technologies · · 2 min read
The short answer
At least quarterly to meet most compliance requirements, monthly as a practical baseline, and continuously or weekly for internet-facing systems where you can. Then scan again after any significant change, such as a new firewall, a new server or a major upgrade.
PCI DSS
- Internal scans at least once every three months and after significant change (requirement 11.3.1), performed with authentication (11.3.1.2), with high-risk and critical vulnerabilities resolved and rescanned.
- External scans at least once every three months by a PCI SSC Approved Scanning Vendor (ASV), with a passing result (11.3.2), plus scans after significant change.
ASV scans are a specific service with their own attestation; a general vulnerability report is not a substitute for one.
HIPAA
The HIPAA Security Rule requires covered entities and business associates to perform an accurate and thorough risk analysis and to implement reasonable safeguards, but it does not name a scan frequency. Regular vulnerability scanning is the standard way to support that risk analysis with evidence. Proposed updates to the Security Rule published in early 2025 would add explicit vulnerability scanning and penetration testing requirements; check the status of that rulemaking for your clients.
CIS Controls and other frameworks
- CIS Controls v8, Control 7: automated authenticated and unauthenticated scans of internal assets at least quarterly (7.5), externally exposed assets at least monthly (7.6), and risk-based remediation at least monthly (7.7).
- SOC 2 and ISO 27001: no fixed interval, but auditors expect a defined cadence that you can show was followed.
- Cyber Essentials (UK): focuses on patching within 14 days for high and critical updates rather than a scan schedule.
Cyber insurance
Underwriting questionnaires increasingly ask whether you scan regularly, whether internet-facing systems are covered and how quickly critical vulnerabilities are patched. Requirements vary by insurer and policy, so read the client's application. The most useful evidence is a dated history of reports showing findings being fixed.
Setting a cadence per client
| Client profile | Internal (credentialed) | External |
|---|---|---|
| Small office, no regulated data | Monthly | Monthly |
| Takes card payments | Monthly, plus quarterly evidence | Quarterly ASV, plus monthly own scans |
| Healthcare or other regulated data | Monthly | Weekly to monthly |
| Public-facing applications or many remote users | Monthly | Weekly or continuous |
A higher cadence is only useful if the reports get read. Match scan frequency to how often the client can act, and use remediation SLAs to keep the two in step. Varaxon Scan Hub keeps every report per client, so a monthly cadence builds the dated evidence trail auditors and insurers ask for.
Common questions
Is an annual vulnerability scan enough?
Rarely. New vulnerabilities are published every day and many are exploited within weeks. Annual scanning leaves most of the year unmeasured and does not meet PCI DSS or CIS Controls expectations.
Should I rescan after patching?
Yes. A rescan confirms the fix worked and gives you evidence that the finding was resolved, which PCI DSS explicitly requires for high-risk and critical internal findings.
Turn your next scan export into a client-ready report.
Run a free pre-flight check