PCI ASV Scans: Quarterly PCI Compliance Scanning

An ASV scan, often just called a PCI scan, is the external vulnerability scan that PCI DSS v4.0.1 Requirement 11.3.2 asks for. At least once every three months, a PCI SSC Approved Scanning Vendor (ASV) scans every internet-facing IP address and domain in scope. You fix or dispute what it finds and rescan until the ASV issues a passing report. If your validation includes Requirement 11.3.2, you need four passing scans a year, one in each three-month period.

Sovereign Secure is not an ASV. Your scans run through our PCI SSC Approved Scanning Vendor partner, and we manage the programme around them: scope, result reviews, false-positive disputes with the ASV, and rescans timed around your PCI DSS assessment. As a PCI SSC-approved Qualified Security Assessor (QSA) company, we read an ASV report the way an assessor does. ASV scanning is one part of our PCI DSS compliance services.

What is an Approved Scanning Vendor?

An Approved Scanning Vendor is a company the PCI Security Standards Council has qualified to run external scans for PCI DSS, using a scan solution the Council has tested. Only a company on the PCI SSC list of Approved Scanning Vendors can produce a report that meets Requirement 11.3.2. Output from any other scanner does not count.

ASVs follow the Council’s ASV Program Guide (in the PCI SSC document library), which sets the rules for scope, failures and disputes. Each report has three parts: an Attestation of Scan Compliance signed by you and the ASV, a summary by component, and the vulnerability details.

Who needs a PCI ASV scan?

Anyone whose validation includes Requirement 11.3.2. Your acquirer can also ask for scans, so check its compliance portal; our guide to Worldpay PCI compliance shows how one acquirer’s programme handles them. If you are unsure of your questionnaire, our guide to which PCI SAQ you need walks through the options.

How our managed ASV scan service works

The ASV runs the scan and decides pass or fail. We do the work around it.

What does an ASV scan cover?

Every externally facing IP address and domain that is part of your cardholder data environment (CDE) or gives a route into it. An ASV vulnerability scan looks at those systems from the internet, without logging in, for known vulnerabilities and weak configurations. You declare the scope, and anything else the ASV discovers must be scanned or explained.

The scan must run without interference: a scan blocked by your intrusion prevention system or WAF cannot give a valid result. A PCI vulnerability scan of this kind is narrower than an internal scan or a penetration test. If you are new to scanning, our guide to what a vulnerability scan is explains the basics.

What counts as a passing ASV scan?

A scan passes when no component in scope has a vulnerability with a CVSS base score of 4.0 or higher, apart from any the ASV has accepted on dispute. The Program Guide also fails some findings whatever their score.

What happens if you fail an ASV scan?

A failed scan is not a failed quarter. You fix the findings or dispute them with evidence, then rescan until that three-month period has a passing result.

1. Triage. We sort each failure into real vulnerability, false positive, compensating control or out of scope.
2. Remediate. Your team fixes the real issues, working from our priority list.
3. Dispute. We prepare the evidence, for example proof that a Linux distribution backported a fix while the version banner still shows the old number.
4. ASV review. The ASV accepts or rejects each dispute and records accepted exceptions in the report.
5. Rescan. Several reports can be combined to show everything in scope passed in that period.

Quarterly ASV scan calendar

Scan early in each three-month period so there is time to fix, dispute and rescan before it ends. Your periods do not have to follow calendar quarters; this example assumes they do.

Your assessor will look for a passing scan in each of the four periods before your SAQ or ROC date. In your first year, four passing scans are not required if your most recent scan passed, you have a documented three-monthly scanning process, and earlier findings were fixed and rescanned. After any significant change, Requirement 11.3.2.1 also calls for an external scan, which need not be run by an ASV.

ASV scans vs internal scans and penetration tests

PCI DSS needs all three; none replaces the others.

We run authenticated internal scans through our vulnerability scanning services and carry out PCI DSS penetration testing, including segmentation tests, on the same schedule.

Preparing for your first ASV scan

• Know your scope. Reconcile your asset list with DNS, so the ASV does not find forgotten subdomains first.
• Shrink the attack surface. Close remote management and database ports that need not be public, patch internet-facing software, retire unsupported operating systems and disable SSL and early TLS.
• Clear the way. Allowlist the ASV’s scanner in your IPS and WAF for the scan window, and gather evidence for backported patches in advance.

Our guide on how to pass a PCI ASV scan covers the common failures in more detail.

How much does an ASV scan cost?

Cost depends mainly on how many IP addresses and domains are in scope. We give a fixed annual price after scoping, rather than a list price that may not fit your estate.

Some acquirers include ASV scans in their compliance portals, so check what your merchant agreement already covers. For the whole budget, including assessment and testing, see our guide to PCI compliance cost.

Why Sovereign Secure for ASV scanning

• Managed by an assessor company. We are a PCI SSC-approved QSA, Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA) company, and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028.
• Independent evidence. Reports are produced and attested by our ASV partner, not by us.
• One plan. Scans, penetration tests and your PCI DSS audit can share one set of dates.
• UK head office in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. Clients include Fiserv, Cashplus and Ticketmaster.

Get a quote for PCI ASV scanning

Send us your public IP addresses and domains, your SAQ type or ROC date, and your last ASV report if you have one. We will confirm the scope and come back with a fixed annual price. Contact us or call +44 161 523 5276.