ASSESS AND MONITOR
PCI COMPLIANCE

PCI Approved Scanning Vendor 

PCI ASVs are PCI SSC approved and certified companies that help implement specific PCI DSS requirements. PCI ASV performs ASV scans required for the company’s compliance with PCI DSS, verify and provide you with a valid report for evidence.

PCI ASVs are the authority to issue you certified scanning report, so you’ll almost always need to work with one.

PCI ASV performs quarterly external vulnerability scans that must be performed by the Approved Scanning Vendor (ASV) to meet the PCI DSS 11.2.2 requirement.

Vulnerabilities in Internet-facing networks can occur at any enterprise level. PCI DSS requires businesses to conduct routine ASV network scans at all merchants to identify potential flaws in external networks before hackers.

ASV scans must be performed by a PCI Approved Scanning Vendor (ASV).

This article explains what PCI ASV is and how it works to help businesses comply with PCI DSS.

What is a PCI Approved Scanning Vendor (ASV)?

Approved Scanning Vendors, commonly known as ASV, is a PCI SSC notified body that offers a range of data security services to evaluate how an organization’s PCI DSS meets specific scanning requirements.

PCI ASV scan for an external vulnerability from the outside of an organization’s network or website. Such scanning services from ASV Service providers can provide insight into any data security changes that need to be made and decide whether they comply with the organization’s PCI DSS requirement.

What Are PCI ASV Scanning Processes?

The stages of the PCI ASV external vulnerability scanning are as follows:

• Scoping: The scanning scope is carried out by the customer to cover all components of the internet-facing system that forms a part of the cardholder data environment.
• Scan: ASV company performs vulnerability scanning using its scanning solution. Multiple sections of the Cardholder Data Environment (CDE) can be scanned separately during scans.
• Reporting/remediation: After the scanning is completed, the interim reports’ results are presented to the customer, and the customer makes the necessary remediations.
• Dispute Resolution: The client and ASV collaborate to document and resolve controversial screening results.
• Rescan (if required): Rescans will continue until a successful scan is created that resolves conflicts and exceptions.
• Final Reporting: If there are no scans’ vulnerabilities, a report approved by PCI ASV is generated. The report is sent and delivered to the customer securely.

Scoping is the first and primary step of ASV scanning. First, ASV will ask the merchant to provide a list of all components connected to the internet. Ultimately, the merchant is responsible for determining the scanning scope, even if they appoint a third party to consult.

If you need ASV scan for your company contact us to to fulfil your PCI DSS requirement.