{"id":581,"date":"2020-04-19T10:01:30","date_gmt":"2020-04-19T10:01:30","guid":{"rendered":"http:\/\/www.pcidssguide.com\/?p=581"},"modified":"2023-10-09T13:44:24","modified_gmt":"2023-10-09T13:44:24","slug":"pci-vulnerability-scan-requirements","status":"publish","type":"post","link":"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/","title":{"rendered":"What are the Requirements for PCI DSS Vulnerability Scanning?"},"content":{"rendered":"\n\n\n\n\n<p>Whether you are aware of it or not, hackers can exploit your network&#8217;s vulnerabilities and gain access to your sensitive data.<\/p>\n\n\n\n<p>Web server shortcomings, e-mail clients, POS applications, and operating systems can allow attackers to access your systems. Installing security updates and patches for cardholder systems or sensitive data environments will help fix many of the newly found bugs and vulnerabilities before attackers have a chance to exploit them.<\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/how-to-successfully-pass-a-pci-compliance-scan\/\">See Also: How to Successfully Pass a PCI Compliance Scan<\/a><\/strong> <\/p>\n\n\n\n<p>But to fix these vulnerabilities, you need to find them first. For this, you need to scan your systems by testing for vulnerabilities.<\/p>\n\n\n\n<p>An essential requirement of the Payment Card Industry Data Security Standard (PCI DSS) is 11.2, also known as the PCI vulnerability scanning requirement. This requirement requires companies to perform internal and external vulnerability scans four times a year in three months and after any significant network changes, irrespective of its size.<\/p>\n\n\n\n<p>But <a href=\"https:\/\/pcidssguide.com\/pci-dss-requirement-11\/\">PCI DSS requirement 11.2<\/a> is not just about scanning network components and servers to identify vulnerabilities before attackers. It is also about improving and improving processes to stop vulnerabilities from reappearing.<\/p>\n\n\n\n<p>It takes more effort than most people realize to meet PCI DSS requirement 11.2. Here are helpful hints as you can apply it to meet PCI DSS vulnerability scanning requirements.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>How Vulnerability Scanners Work<\/strong><\/h2>\n\n\n\n<p>An internal or external PCI DSS vulnerability scan checks the configuration of specific devices and software through internal or external IP addresses, such as ports and services, to check for vulnerabilities.<\/p>\n\n\n\n<p>PCI vulnerability scanners provide different tools and scripts designed for vulnerability testing. Such tools vary but may include software operated by the Certified Scan Provider (ASV), command-line files, GUI interfaces, and open source technologies.<\/p>\n\n\n\n<p><a href=\"https:\/\/www.tenable.com\/products\/nessus\">Tenable Nessus<\/a> and <a href=\"https:\/\/www.qualys.com\/\">Qualys<\/a> are widely recognized and used vulnerability scanning tools.<\/p>\n\n\n\n<p>Scan tools run a series of control scenarios on your networks, commonly known as a vulnerability scan, which can take 1-3 hours for a quick scan or over 10 hours for a more extensive scan. Scan times may differ depending on your environment.<\/p>\n\n\n\n<p>Control scenarios are designed to define device settings, configurations and behaviors that can lead to exploitable vulnerabilities. For example, if your scan examines operating system versions and finds an outdated Windows XP operating system, that operating system will be marked as vulnerable.<\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/what-you-need-to-know-about-internal-penetration-tests\/\">See Also: What You Need to Know About Internal Penetration Tests<\/a><\/strong><\/p>\n\n\n\n<p>Vulnerability scanning is designed to be non-intrusive. It scans merely alerts and gives you a logged overview of suspected vulnerabilities for you to take action. Vulnerability scanning, unlike penetration testing, does not exploit vulnerabilities in your network and does not take testing further.<\/p>\n\n\n\n<p> <strong><a href=\"https:\/\/pcidssguide.com\/what-you-should-know-about-external-penetration-testing\/\">See Also: What You Should Know About External Penetration Testing<\/a><\/strong> <\/p>\n\n\n\n<p>As you check your scan results, you will most likely find CVE (common vulnerability and exposure) numbers in your notifications. If not provided to you by the scanning provider, it will be easier for you to become familiar with the <a href=\"https:\/\/nvd.nist.gov\/\">National Vulnerability Database<\/a> to examine CVE records to identify and prioritize risks.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What are the Differences Between Internal and External Vulnerability Scans?<\/strong><\/h2>\n\n\n\n<p>PCI DSS requires two independent PCI vulnerability scanning methods, internal and external. Because internal and external scans evaluate a network by scanning it from different perspectives.<\/p>\n\n\n\n<p>An external PCI vulnerability scan checks for vulnerabilities at the end of your network or website. An internal vulnerability scan looks for network vulnerabilities by simply scanning local resources within your network.<\/p>\n\n\n\n<p>Generally, only ASV scans are considered sufficient for PCI DSS compliance concerning internal and external vulnerability scanning. Still, both external ASV scans and local vulnerability scans are required for PCI compliance.<\/p>\n\n\n\n<p>Your ASV will not perform your quarterly internal PCI vulnerability scanning. ASVs only perform external security scans. Your ASV may also install an internal vulnerability scanning tool on your network, but this does not eliminate the need for internal and external scanning.<\/p>\n\n\n\n<p>Therefore, it is best to double-check that you have performed your internal scanning and followed your vulnerability management procedures.<\/p>\n\n\n\n<p>You can choose from the following options to meet internal vulnerability scanning requirements:<\/p>\n\n\n\n<ul>\n<li>Select your ASV or another service provider for a built-in vulnerability scanning tool.<\/li>\n\n\n\n<li>Download and use an open-source internal vulnerability scanning tool from the internet.<\/li>\n\n\n\n<li>Purchase Nessus or Qualys and use.<\/li>\n<\/ul>\n\n\n\n<p>Remember that the device you will use must be installed and used by a professional even after you purchase or update it.<\/p>\n\n\n\n<p>Your company is fully responsible for the vulnerability scanning process, even if the security scans are outsourced. In short, it is your job to ensure compliance with PCI DSS.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What Does It Mean to Use ASV for External Network Scans?<\/strong><\/h2>\n\n\n\n<p>An ASV company certified by PCI must perform external network scans, and there are no exceptions to this. You can find the list of more than 100 ASVs on the PCI SSC website and work with the ASV company suitable for your company, among many options.<\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/what-is-a-pci-approved-scanning-vendor-asv\/\">See Also: What is a PCI Approved Scan Vendor (ASV)?<\/a><\/strong><\/p>\n\n\n\n<p>Approved Scan Vendors (ASV) are authorized companies that provide security scanning services approved by PCI SSC to perform external network tests. ASV companies enter the certificate renewal process every year.<\/p>\n\n\n\n<p>During the annual recertification process, each ASV must run the PCI scan tool on sites full of vulnerabilities approved by the PCI Council to check for vulnerabilities. The tool has identified an overlooked and to pass the test successfully.<\/p>\n\n\n\n<p>You can view the authorized ASV list <a href=\"https:\/\/www.pcisecuritystandards.org\/assessors_and_solutions\/approved_scanning_vendors\">here.<\/a><\/p>\n\n\n\n<p>After your scan is completed, ASV provides you with the result report. What happens after the scan and report are complete is entirely up to you. You are responsible for correcting any errors that may be found. ASV will not provide you with an approved and valid report without correcting the weaknesses in the report.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What is a Qualified Internal Source for Vulnerability Scanning?<\/strong><\/h2>\n\n\n\n<p>PCI DSS states that a qualified person should perform internal vulnerability scanners and be partially independent of the scanned system. For example, if the browser is the same person as the person who fixes the discovered vulnerabilities, a conflict of interest is likely to occur at this point.<\/p>\n\n\n\n<p>For example, choose to perform an internal scan of your firewalls. You can run the scans from a qualified security professional, your ASV, or a professional employee who is not subject to firewall management.<\/p>\n\n\n\n<p>Having only one staff member is not a valid reason. If the working device is in control of it, it should not manage scans.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>How Should Many Security Scans Be Performed to Meet PCI DSS Requirements?<\/strong><\/h2>\n\n\n\n<p>PCI DSS requires three types of network scanning. PCI DSS Requirement 11.2 covers security scans in general. It states that you should run internal and external network vulnerability scans every three months and after any significant network changes. Qualified internal or external parties must conduct security scans.<\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/ensure-your-organizations-security-with-credential-based-vulnerability-assessment\/\">See Also: Ensure Your Organization\u2019s Security With Credential-Based Vulnerability Assessment<\/a><\/strong><\/p>\n\n\n\n<p>Testing procedures for internal security scans should verify that internal scans have been performed every four months in the last 12 months and that rescans have occurred until all &#8220;high risk&#8221; vulnerabilities identified in PCI DSS requirement 6.1 are resolved.<\/p>\n\n\n\n<p>External scans must be done through an Approved Scan Vendor (ASV)<\/p>\n\n\n\n<p>According to PCI DSS requirements, every company must perform internal and external scans every three months regardless of size. In other words, you need to do a total of eight scans per year for external and internal scans.<\/p>\n\n\n\n<p>Many organizations perform four external vulnerability scans each year but often cannot perform any internal vulnerability scans because they forget. Some treat vulnerability scanning as an occasional, isolated point check process that relies heavily on resolving urgent problems.<\/p>\n\n\n\n<p>Remember, you cannot comply with PCI DSS requirement 11.2 until you have performed at least four external network vulnerability scans per year, one per quarter, and once per quarter, for a total of four internal network vulnerability scans per year.<\/p>\n\n\n\n<ul>\n<li><strong>Quarterly External Vulnerability Scans (PCI DSS Requirement 11.2.2) &#8211; <\/strong>These scans must be performed at least every three months by an external scanning company certified as an Approved Scan Vendor (ASV) by the PCI council. An internal employee of your organization cannot perform ASV scans. All external IP addresses within your PCI DSS scope must be included in these scan reports. The purpose of this requirement is to identify all vulnerabilities in your systems that may be present and exploited by an attacker over the Internet.<\/li>\n\n\n\n<li><strong>Quarterly Internal Vulnerability Scans (PCI DSS Requirement 11.2.1) &#8211;<\/strong> As the name suggests, internal vulnerability scans must be performed within your networks at least every three months. Internal network vulnerability scans can be performed by anyone experienced in vulnerability scanning. Most organizations use an internal worker to perform these scans with an automated vulnerability scanning solution such as Nessus, Qualys or OpenVAS. The purpose of this requirement is to identify any vulnerabilities within your network that could be exploited by an attacker. All &#8220;critical&#8221; or &#8220;high&#8221; vulnerabilities detected as a result of the scan must be resolved and verified with rescanning reports.<\/li>\n\n\n\n<li><strong>Annual Penetration Testing (PCI DSS Requirement 11.3) &#8211;<\/strong> A qualified penetration tester should carry out penetration testing at least once a year to verify that these complex manual methods can not be used to gain unauthorized access to your systems. Penetration tests are usually performed by a third party but can also be done by a qualified in-house person with organizational independence. The person performing the penetration test should not be the same person responsible for configuring or managing the systems under test. The penetration test should be done over the Internet to external networks and from an internal perspective to your internal network.<\/li>\n\n\n\n<li><strong>Segmentation Test (PCI DSS Requirement 11.3.4) &#8211;<\/strong> Segmentation Tests are special internal penetration tests required for organizations using segmentation to isolate cardholder data environment networks from other internal networks completely. Segmentation tests verify that access to in-scope networks is not allowed from out-of-scope networks. Segmentation tests should be conducted annually for merchants and every six months for service providers. If you are not implementing any segmentation in your PCI environment, you do not need to perform segmentation testing.<\/li>\n<\/ul>\n\n\n\n<p>All the above scanning requirements should be repeated frequently. Additionally, each of these scans should be repeated after significant changes that could introduce new vulnerabilities in your environment.<\/p>\n\n\n\n<p>Rescans are required to ensure that the changes do not introduce new vulnerabilities in your environment. Keeping the reports of the above scan types for a few years will help you check in case of any problems. You can also provide them as proof of your PCI DSS compliance if desired.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Which Systems Should Be Scanned?<\/strong><\/h2>\n\n\n\n<p>Technically, PCI DSS only requires you to perform vulnerability scans on covered networks, processes, and systems. It is, therefore, crucial that you understand and determine your PCI scope.<\/p>\n\n\n\n<p>At this point, if you have any doubts, you may need someone to help determine your PCI and scanning scope. Otherwise, your scans may miss essential networks. If you want to validate PCI compliance and your scan, you need to know what needs to be scanned and produce results accordingly.<\/p>\n\n\n\n<p>Suppose you have a flat network without segmentation. In that case, you don&#8217;t have to worry about PCI coverage because flat networks do not have segmentation capability, which means scanning the entire network, and scanning must be done for all network components as the entire network will be included in PCI scope.<\/p>\n\n\n\n<p>In this context, it is necessary to pay attention to how complex networks that benefit from segmentation changes throughout the year and adapt vulnerability scans accordingly.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Should You Perform a Security Scan Again After Network Changes?<\/strong><\/h2>\n\n\n\n<p>PCI DSS requires you to perform vulnerability scans annually and after every significant change. So what does a big difference mean, and what does it mean?<\/p>\n\n\n\n<p>PCI DSS states that a significant change depends on how you configure the system. In general, however, if an update or change may require access to cardholder data or affect the cardholder&#8217;s data environment protection, this can be considered a significant change.<\/p>\n\n\n\n<p>A new security scan is required in the following situations:<\/p>\n\n\n\n<ul>\n<li>When you add or change something that could introduce new vulnerabilities in your environment<\/li>\n\n\n\n<li>If high-risk findings are reported in your risk analysis<\/li>\n\n\n\n<li>If you are unsure or undecided about the effects of change<\/li>\n<\/ul>\n\n\n\n<p>Below are a few key examples of changes:<\/p>\n\n\n\n<ul>\n<li>Adding new servers or system components to the CDE<\/li>\n\n\n\n<li>Changing interfaces<\/li>\n\n\n\n<li>Move cardholder data to a new server<\/li>\n\n\n\n<li>Upgrading or updating products<\/li>\n\n\n\n<li>Changing your firewall device or software<\/li>\n\n\n\n<li>Adding new or different middleware<\/li>\n\n\n\n<li>Removing systems that store cardholder data<\/li>\n\n\n\n<li>Adding encryption implementations or new methods<\/li>\n\n\n\n<li>Changing the network topology<\/li>\n\n\n\n<li>Changing firewall rules<\/li>\n<\/ul>\n\n\n\n<p>You don&#8217;t have to worry about small changes. Your eight internal and external scans during the year will include minor changes.<\/p>\n\n\n\n<p>Below are a few examples of non-significant changes:<\/p>\n\n\n\n<ul>\n<li>Replacing file integrity monitoring (FIM) software<\/li>\n\n\n\n<li>Replacing antivirus products<\/li>\n\n\n\n<li>Removing dismissed administrative personnel from the records<\/li>\n<\/ul>\n\n\n\n<p>Security scans should be carried out within a reasonable time after significant changes. For example, if you make significant changes to your system after your quarterly external scan, you should not wait for your next quarterly external scan. You should test changes and perform vulnerability scans as soon as possible.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What are the differences between PCI DSS penetration tests and PCI DSS vulnerability scans?<\/strong><\/h2>\n\n\n\n<p>Penetration experts observe your network environment like a hacker. After finding possible vulnerabilities, it tries to hijack systems using vulnerabilities. In simple terms, pentesters try to break into your company&#8217;s network to find gaps in the defense.<\/p>\n\n\n\n<p>In vulnerability scans, security weaknesses are tried to be detected by using automated tools. When security vulnerabilities are detected, the test is not taken to the advanced stage; only the findings found are reported.<\/p>\n\n\n\n<p><strong><a href=\"https:\/\/pcidssguide.com\/pci-penetration-test-requirements\/\">See Also: What Are PCI Penetration Test Requirements?<\/a><\/strong><\/p>\n\n\n\n<p>PCI DSS Requirement 11.3, which applies to SAQ C and SAQ D, requires internal and external penetration testing at both the CDE network and application layers. However, PCI DSS is not limited to penetration testing. Any organization wishing to take an honest look at information security environments should conduct a penetration test.<\/p>\n\n\n\n<p>In summary, both internal and external vulnerability scanning is not the same as penetration testing.<\/p>\n\n\n\n<p>To understand the difference more clearly, we can look at the following two main variations:<\/p>\n\n\n\n<ul>\n<li>While vulnerability scanning is done with automated tools, penetration testing requires a live person to investigate the network&#8217;s complexity actively.<\/li>\n\n\n\n<li>A vulnerability scan only reveals potential vulnerabilities. &nbsp;During a penetration test, the tester should check the vulnerability and find the vulnerability&#8217;s root cause providing access to protected networks or stored sensitive data.<\/li>\n<\/ul>\n\n\n\n<p>Practically, PCI DSS vulnerability scans and penetration tests must be implemented to ensure maximum network protection. Vulnerability scans provide information about your network security weekly, monthly or quarterly, while penetration tests are a more detailed assessment of your overall cybersecurity posture.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Vulnerability scans should be ongoing.<\/strong><\/h2>\n\n\n\n<p>Vulnerability scanning is probably necessary, even if your business doesn&#8217;t process, store, or transfer credit card data. Whether you are processing credit card data or not, if you have any public assets connected to the internet, you must scan your environment.<\/p>\n\n\n\n<p>If you have significant weaknesses in your systems, you need to be aware of it. Otherwise, a hacker could potentially bypass your protections and endanger your systems.<\/p>\n\n\n\n<p>Vulnerability scans are one of the easiest ways for any organization to identify vulnerabilities in their network. The main thing to consider is how you can increase your vulnerability management process&#8217;s effectiveness based on the effort, time, and money you put into it.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A PCI vulnerability scan, whether internal or external, does not, like an antivirus software, traverse any network file. In order to check for vulnerabilities certain devices, such as internal or external IP addresses such as ports and services, must be configured.<\/p>\n","protected":false},"author":1,"featured_media":582,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[33,35],"tags":[103],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>What are the Requirements for PCI DSS Vulnerability Scanning? - PCI DSS GUIDE<\/title>\n<meta name=\"description\" content=\"PCI DSS requires companies to perform internal and external vulnerability scans four times a year in three months and after any significant network changes, irrespective of its size.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What are the Requirements for PCI DSS Vulnerability Scanning? - PCI DSS GUIDE\" \/>\n<meta property=\"og:description\" content=\"PCI DSS requires companies to perform internal and external vulnerability scans four times a year in three months and after any significant network changes, irrespective of its size.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/\" \/>\n<meta property=\"og:site_name\" content=\"PCI DSS GUIDE\" \/>\n<meta property=\"article:published_time\" content=\"2020-04-19T10:01:30+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-10-09T13:44:24+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-Vulnerability-Scanning.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"1280\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Surkay Baykara\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Surkay Baykara\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/\"},\"author\":{\"name\":\"Surkay Baykara\",\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741\"},\"headline\":\"What are the Requirements for PCI DSS Vulnerability Scanning?\",\"datePublished\":\"2020-04-19T10:01:30+00:00\",\"dateModified\":\"2023-10-09T13:44:24+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/\"},\"wordCount\":2580,\"publisher\":{\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741\"},\"image\":{\"@id\":\"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-Vulnerability-Scanning.jpg\",\"keywords\":[\"vulnerability scan\"],\"articleSection\":[\"PCI DSS Requirement 11\",\"PCI DSS Vulnerability Scanning\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/\",\"url\":\"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/\",\"name\":\"What are the Requirements for PCI DSS Vulnerability Scanning? - PCI DSS GUIDE\",\"isPartOf\":{\"@id\":\"https:\/\/pcidssguide.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-Vulnerability-Scanning.jpg\",\"datePublished\":\"2020-04-19T10:01:30+00:00\",\"dateModified\":\"2023-10-09T13:44:24+00:00\",\"description\":\"PCI DSS requires companies to perform internal and external vulnerability scans four times a year in three months and after any significant network changes, irrespective of its size.\",\"breadcrumb\":{\"@id\":\"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/#primaryimage\",\"url\":\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-Vulnerability-Scanning.jpg\",\"contentUrl\":\"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-Vulnerability-Scanning.jpg\",\"width\":1920,\"height\":1280,\"caption\":\"PCI Vulnerability Scanning\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/pcidssguide.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"What are the Requirements for PCI DSS Vulnerability Scanning?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/pcidssguide.com\/#website\",\"url\":\"https:\/\/pcidssguide.com\/\",\"name\":\"PCI DSS GUIDE\",\"description\":\"PCI Compliance Guide For All Business\",\"publisher\":{\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/pcidssguide.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741\",\"name\":\"Surkay Baykara\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/b90b993a161f1830913c4409f7b4faa0?s=96&d=monsterid&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/b90b993a161f1830913c4409f7b4faa0?s=96&d=monsterid&r=g\",\"caption\":\"Surkay Baykara\"},\"logo\":{\"@id\":\"https:\/\/pcidssguide.com\/#\/schema\/person\/image\/\"},\"description\":\"A passionate Senior Information Security Consultant working at Cyberwise. Over the past 15+ years my professional career has included several positions beginning as a developer and IT administrator, working my way up to a senior Technical Performance Consultant before joining Biznet back in 2015. I had several different roles at Cyberwise, including Penetration Tester and PCI DSS QSA. In my job as a QSA, I found my passion and worked closely with the Audit and Compliance team. I've been working inside InfoSec for over 15 years, coming from a highly technical background. I have earned several certifications during my professional career including; CEH, CISA, CISSP, and PCI QSA.\",\"sameAs\":[\"https:\/\/www.pcidssguide.com\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What are the Requirements for PCI DSS Vulnerability Scanning? - PCI DSS GUIDE","description":"PCI DSS requires companies to perform internal and external vulnerability scans four times a year in three months and after any significant network changes, irrespective of its size.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/","og_locale":"en_US","og_type":"article","og_title":"What are the Requirements for PCI DSS Vulnerability Scanning? - PCI DSS GUIDE","og_description":"PCI DSS requires companies to perform internal and external vulnerability scans four times a year in three months and after any significant network changes, irrespective of its size.","og_url":"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/","og_site_name":"PCI DSS GUIDE","article_published_time":"2020-04-19T10:01:30+00:00","article_modified_time":"2023-10-09T13:44:24+00:00","og_image":[{"width":1920,"height":1280,"url":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-Vulnerability-Scanning.jpg","type":"image\/jpeg"}],"author":"Surkay Baykara","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Surkay Baykara","Est. reading time":"12 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/#article","isPartOf":{"@id":"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/"},"author":{"name":"Surkay Baykara","@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741"},"headline":"What are the Requirements for PCI DSS Vulnerability Scanning?","datePublished":"2020-04-19T10:01:30+00:00","dateModified":"2023-10-09T13:44:24+00:00","mainEntityOfPage":{"@id":"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/"},"wordCount":2580,"publisher":{"@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741"},"image":{"@id":"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/#primaryimage"},"thumbnailUrl":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-Vulnerability-Scanning.jpg","keywords":["vulnerability scan"],"articleSection":["PCI DSS Requirement 11","PCI DSS Vulnerability Scanning"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/","url":"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/","name":"What are the Requirements for PCI DSS Vulnerability Scanning? - PCI DSS GUIDE","isPartOf":{"@id":"https:\/\/pcidssguide.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/#primaryimage"},"image":{"@id":"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/#primaryimage"},"thumbnailUrl":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-Vulnerability-Scanning.jpg","datePublished":"2020-04-19T10:01:30+00:00","dateModified":"2023-10-09T13:44:24+00:00","description":"PCI DSS requires companies to perform internal and external vulnerability scans four times a year in three months and after any significant network changes, irrespective of its size.","breadcrumb":{"@id":"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/#primaryimage","url":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-Vulnerability-Scanning.jpg","contentUrl":"https:\/\/pcidssguide.com\/wp-content\/uploads\/2020\/04\/pci-Vulnerability-Scanning.jpg","width":1920,"height":1280,"caption":"PCI Vulnerability Scanning"},{"@type":"BreadcrumbList","@id":"https:\/\/pcidssguide.com\/pci-vulnerability-scan-requirements\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/pcidssguide.com\/"},{"@type":"ListItem","position":2,"name":"What are the Requirements for PCI DSS Vulnerability Scanning?"}]},{"@type":"WebSite","@id":"https:\/\/pcidssguide.com\/#website","url":"https:\/\/pcidssguide.com\/","name":"PCI DSS GUIDE","description":"PCI Compliance Guide For All Business","publisher":{"@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/pcidssguide.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/2ddca45b459107e6bc5b46c0cbc9c741","name":"Surkay Baykara","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/b90b993a161f1830913c4409f7b4faa0?s=96&d=monsterid&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/b90b993a161f1830913c4409f7b4faa0?s=96&d=monsterid&r=g","caption":"Surkay Baykara"},"logo":{"@id":"https:\/\/pcidssguide.com\/#\/schema\/person\/image\/"},"description":"A passionate Senior Information Security Consultant working at Cyberwise. Over the past 15+ years my professional career has included several positions beginning as a developer and IT administrator, working my way up to a senior Technical Performance Consultant before joining Biznet back in 2015. I had several different roles at Cyberwise, including Penetration Tester and PCI DSS QSA. In my job as a QSA, I found my passion and worked closely with the Audit and Compliance team. I've been working inside InfoSec for over 15 years, coming from a highly technical background. I have earned several certifications during my professional career including; CEH, CISA, CISSP, and PCI QSA.","sameAs":["https:\/\/www.pcidssguide.com"]}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/posts\/581"}],"collection":[{"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/comments?post=581"}],"version-history":[{"count":3,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/posts\/581\/revisions"}],"predecessor-version":[{"id":2236,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/posts\/581\/revisions\/2236"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/media\/582"}],"wp:attachment":[{"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/media?parent=581"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/categories?post=581"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pcidssguide.com\/wp-json\/wp\/v2\/tags?post=581"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}