PCI DSS vulnerability scanning requirements: internal, external and ASV scans

If you store, process or transmit payment card data, or manage systems that can affect its security, the Payment Card Industry Data Security Standard (PCI DSS) sets specific rules for vulnerability scanning. Most of them sit in Requirement 11.3 of PCI DSS v4.0.1, the current version. This guide summarizes what those rules ask for in plain language, and how to keep the evidence an assessor will want to see.

The requirements at a glance

Requirements 11.3.1.1 and 11.3.1.2 were new in PCI DSS v4.0 and became mandatory on 31 March 2025, so assessments now expect both.

Internal scans

Internal scans look at the cardholder data environment from the inside: servers, workstations, databases and network devices in scope. You can run them yourself with any capable scanner, such as Tenable Nessus, Greenbone OpenVAS, Qualys or Rapid7, as long as the person running them is qualified and independent of the systems being tested.

Authenticated scanning is now required. In practice that means giving the scanner an account that can log in to each host, so it can see installed patches and settings. Keep a list of any in-scope systems that cannot accept credentials and why. Our guide to credentialed vs non-credentialed scans covers how to set this up safely.

High-risk and critical findings, as defined by your own risk ranking under Requirement 6.3.1, must be fixed and a rescan must show them gone. For everything else, you need a documented targeted risk analysis that says how and when those findings are handled. A ranking that uses exploitation evidence, such as the CISA KEV catalog and EPSS, alongside CVSS, makes that analysis much easier to defend.

External ASV scans

External scans look at your internet-facing systems the way an attacker would. The quarterly external scans must be run by an Approved Scanning Vendor, a company the PCI Security Standards Council has approved. The council publishes the list of ASVs on its website.

Under the ASV Program Guide, a scan generally fails if it finds any vulnerability scored CVSS 4.0 or higher, along with certain automatic failures regardless of score. You can dispute a finding with evidence, for example that it is a false positive or that a compensating control is in place, and the ASV decides whether to accept the dispute. Passing scans for each quarter, with any rescans, are what your assessor will ask to see.

Rescans and significant changes

A failed scan is not a failed requirement, as long as you fix the findings and rescan within the quarter. Keep both the original scan and the passing rescan. The standard also expects scans after any significant change, such as a new server, a firewall rule change that exposes a service, or a major software upgrade, so plan for more than four scans a year.

Rescans only prove a fix when they use the same scope and settings. Comparing each scan with the previous one, finding by finding, gives you a clear record of what was fixed and when. See proof of fix since the last scan.

Evidence to keep for your assessor

• Four quarters of internal scan reports, with rescans showing high-risk and critical findings resolved.
• Four quarters of passing ASV scan reports, including any disputes and the ASV's decisions.
• Your risk ranking method (Requirement 6.3.1) and targeted risk analysis for lower-risk findings (11.3.1.1).
• The list of systems that cannot accept credentials, with the reason.
• Records of scans after significant changes.
• Patch records showing critical vulnerabilities fixed within one month of release.
• Any risk acceptances or compensating controls, with approvals. See vulnerability risk acceptance.

Keeping the quarterly cycle manageable

The scanning itself is the easy part. The work is ranking the results, getting fixes done before the quarter ends and assembling evidence. We built Varaxon Scan Hub to help with that: it reads internal scan exports from Nessus, Greenbone/OpenVAS, Qualys, Rapid7 and others, ranks findings with CISA KEV, EPSS and CVSS, and compares each scan with the previous one to show what was fixed, what is new and what is still open. Scan Hub is not an Approved Scanning Vendor and does not replace your ASV scans or your assessor. Every new account gets a 14-day free trial, no card needed: see how it works.

Common questions