During initial PCI DSS compliance, which statement about quarterly vulnerability scans is true?

During initial PCI DSS compliance, which statement about quarterly vulnerability scans is true?

• A. Four consecutive quarterly scans must pass for initial compliance.
• B. Quarterly internal scans are not required for initial compliance.
• C. The assessor may allow initial compliance if the most recent scan passed, there are documented quarterly scanning policies, and vulnerabilities have been remediated in follow-up scans.
• D. External scans are optional during initial compliance.

Answer: (C)

The key idea is that during the initial PCI DSS assessment, what matters is showing an active vulnerability management process and the ability to remediate findings, not waiting for a perfect history of scans. The statement that the assessor may allow initial compliance if the most recent scan passed, there are documented quarterly scanning policies, and vulnerabilities have been remediated in follow-up scans captures this approach. It acknowledges that you have ongoing processes (policies) and that remediation is being tracked, with the latest scan confirming no current critical gaps, while still allowing some vulnerabilities to be addressed in subsequent scans. Four consecutive quarterly scans must pass for initial compliance isn’t correct because initial compliance doesn’t require a perfect multi-quarter pass history up front; it centers on having the processes and the most recent scan evidence plus remediation plans. Saying quarterly internal scans are not required is false because internal vulnerability scanning is a core part of PCI DSS 11.2. External scans being optional during initial compliance is also false since external vulnerability scans (by an ASV) are a required element of PCI DSS.

The key idea is that during the initial PCI DSS assessment, what matters is showing an active vulnerability management process and the ability to remediate findings, not waiting for a perfect history of scans. The statement that the assessor may allow initial compliance if the most recent scan passed, there are documented quarterly scanning policies, and vulnerabilities have been remediated in follow-up scans captures this approach. It acknowledges that you have ongoing processes (policies) and that remediation is being tracked, with the latest scan confirming no current critical gaps, while still allowing some vulnerabilities to be addressed in subsequent scans.

Four consecutive quarterly scans must pass for initial compliance isn’t correct because initial compliance doesn’t require a perfect multi-quarter pass history up front; it centers on having the processes and the most recent scan evidence plus remediation plans.

Saying quarterly internal scans are not required is false because internal vulnerability scanning is a core part of PCI DSS 11.2.

External scans being optional during initial compliance is also false since external vulnerability scans (by an ASV) are a required element of PCI DSS.