Who must perform external vulnerability scans?

Who must perform external vulnerability scans?

• A. Any external security provider.
• B. Internal IT staff.
• C. An Approved Scanning Vendor (ASV) approved by the PCI SSC.
• D. Scans are not required.

Answer: (C)

External vulnerability scanning for PCI DSS must be carried out by an Approved Scanning Vendor (ASV) that is approved by the PCI SSC. This requirement exists because PCI DSS relies on standardized, independent scanning of internet-facing assets to identify vulnerabilities in a way that auditors can rely on for validation. An ASV has the approved methods and reporting format needed for PCI reviews, ensuring consistency across organizations and enabling the PCI SSC to verify that external exposures are being accurately assessed. Internal IT staff can perform vulnerability scans, and they’re often valuable for internal networks, but for PCI DSS validation of external assets, the scans must be done by an ASV. That’s why choosing “any external security provider” isn’t sufficient—the vendor must be on the PCI SSC’s list of approved scanning vendors. And obviously, scans are required; stating otherwise would conflict with the PCI DSS requirements.

External vulnerability scanning for PCI DSS must be carried out by an Approved Scanning Vendor (ASV) that is approved by the PCI SSC. This requirement exists because PCI DSS relies on standardized, independent scanning of internet-facing assets to identify vulnerabilities in a way that auditors can rely on for validation. An ASV has the approved methods and reporting format needed for PCI reviews, ensuring consistency across organizations and enabling the PCI SSC to verify that external exposures are being accurately assessed.

Internal IT staff can perform vulnerability scans, and they’re often valuable for internal networks, but for PCI DSS validation of external assets, the scans must be done by an ASV. That’s why choosing “any external security provider” isn’t sufficient—the vendor must be on the PCI SSC’s list of approved scanning vendors. And obviously, scans are required; stating otherwise would conflict with the PCI DSS requirements.