The Payment Card Industry Data Security Standards (PCI DSS) are extremely clear about their vulnerability scanning requirements — both for a PCI internal vulnerability scan and an external one. Any organization that accepts payment card is required to scan its network regularly. Specifically, that means that they need to:

• Scan quarterly;
• Use an approved PCI ASV scanning vendor;
• Scan internally and ext