{"id":1572,"date":"2019-07-24T18:15:27","date_gmt":"2019-07-24T18:15:27","guid":{"rendered":"https:\/\/www.thesslstore.com\/resources\/?p=1572"},"modified":"2019-08-07T07:06:54","modified_gmt":"2019-08-07T07:06:54","slug":"what-is-an-asv-vulnerability-scan","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/resources\/what-is-an-asv-vulnerability-scan\/","title":{"rendered":"What Is An ASV Vulnerability Scan?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">PCI DSS compliance is a requirement for any organization\nthat accepts payment cards. There are numerous PCI DSS requirements, all aimed\nat ensuring your customers\u2019 payment care information is kept safe and secure.\nOne of those requirements, 11.2.2, requires external vulnerability scanning. <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><em>11.2.2 Perform quarterly external\nvulnerability scans, via an Approved Scanning Vendor (ASV) approved by the\nPayment Card Industry Security Standards Council (PCI SSC). Perform rescans as\nneeded, until passing scans are achieved. <\/em><ul><li><em>11.2.2.a\nReview output from the four most recent quarters of external vulnerability\nscans and verify that four quarterly external vulnerability scans occurred in\nthe most recent 12- month period. <\/em><\/li><\/ul><ul><li><em>11.2.2.b\nReview the results of each quarterly scan and rescan to verify that the\nASV&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Program Guide requirements for\na passing scan have been met (for example, no vulnerabilities rated 4.0 or\nhigher by the CVSS, and no automatic failures). <\/em><\/li><\/ul><ul><li><em>11.2.2.c\nReview the scan reports to verify that the scans were completed by a PCI\nSSC&nbsp;&nbsp;&nbsp; Approved Scanning Vendor (ASV).<\/em><\/li><\/ul><\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">And here\u2019s the thing, not just any old scanner will do. You\nneed to go through an Approved Scanning Vendor or ASV. Each ASV has its\nscanning solution tested and approved by the PCI SSC before it can be added to\nthe PCI\u2019s list. Currently there are 97 approved ASVs. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Frankly, for all but the most technically sophisticated\norganizations the requirement to use a third-party scanning service is a major\nbenefit. It would be exceedingly difficult to spin up your own scanner and\nmaintain it at the level required by the PCI. Not to mention cost-prohibitive. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">PCI DSS requires internal and external scanning to be performed at least once quarterly and following any major network change.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What Does an ASV Vulnerability Scan Include?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The internal scans can be handled by your own organization\nbut the external scans needs to be performed by an ASV.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Each scan needs to check for \u201chigh-risk vulnerabilities\u201d as\nspecified in 6.1, specifically the external scan needs to check for all known\nmalware samples and any additional zero-days or exploits that may be present:<\/p>\n\n\n\n<ul class=\"resourcelist wp-block-list\"><li>Designate each vulnerability as low, medium or\nhigh-risk<\/li><li>Follow mitigation strategies to deal with each\nthreat<\/li><li>Re-scan until all high-risk vulnerabilities have\nbeen taken care of<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Following the scan, your ASV will issue a ready-made report\nfor you to submit to your acquiring bank.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How To Get Started With An ASV Vulnerability Scan<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Most ASV scanning solutions are budget-friendly. Specifically Comodo CA\/Sectigo\u2019s which can be acquired for about $80 per year. Setting up Comodo HackerGuardian PCI Scanning takes just a few clicks and can easily satisfy all your scanning and reporting needs. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Remember, scans must be completed quarterly with full documentation turned in to be considered compliant. <\/p>\n\n\n\n<div class=\"blogbannerlt\">\n            <p>67% Off Approved PCI Scanning<\/p>\n            <a class=\"button whitelinebutton blogbtnctl\" href=\"https:\/\/www.thesslstore.com\/comodo\/hacker-guardian-pci-scan-control-center.aspx\">Scan Now<\/a>\n        <\/div>\n","protected":false},"excerpt":{"rendered":"<p>PCI DSS compliance is a requirement for any organization that accepts payment cards. There are numerous PCI DSS requirements, all aimed at ensuring your customers\u2019 payment care information is kept safe and secure. One of those requirements, 11.2.2, requires external &hellip; <a href=\"https:\/\/www.thesslstore.com\/resources\/what-is-an-asv-vulnerability-scan\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[115],"tags":[],"class_list":["post-1572","post","type-post","status-publish","format-standard","hentry","category-pci-compliance"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.9 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>What Is An ASV Vulnerability Scan? - The SSL Store<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.thesslstore.com\/resources\/what-is-an-asv-vulnerability-scan\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What Is An ASV Vulnerability Scan? - The SSL Store\" \/>\n<meta property=\"og:description\" content=\"PCI DSS compliance is a requirement for any organization that accepts payment cards. There are numerous PCI DSS requirements, all aimed at ensuring your customers\u2019 payment care information is kept safe and secure. One of those requirements, 11.2.2, requires external &hellip; Continue reading &rarr;\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.thesslstore.com\/resources\/what-is-an-asv-vulnerability-scan\/\" \/>\n<meta property=\"og:site_name\" content=\"The SSL Store\" \/>\n<meta property=\"article:published_time\" content=\"2019-07-24T18:15:27+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-08-07T07:06:54+00:00\" \/>\n<meta name=\"author\" content=\"tsswordpress\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"tsswordpress\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.thesslstore.com\\\/resources\\\/what-is-an-asv-vulnerability-scan\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.thesslstore.com\\\/resources\\\/what-is-an-asv-vulnerability-scan\\\/\"},\"author\":{\"name\":\"tsswordpress\",\"@id\":\"https:\\\/\\\/www.thesslstore.com\\\/resources\\\/#\\\/schema\\\/person\\\/402dded299e19503b088cf48bf165d59\"},\"headline\":\"What Is An ASV Vulnerability Scan?\",\"datePublished\":\"2019-07-24T18:15:27+00:00\",\"dateModified\":\"2019-08-07T07:06:54+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.thesslstore.com\\\/resources\\\/what-is-an-asv-vulnerability-scan\\\/\"},\"wordCount\":468,\"articleSection\":[\"PCI Compliance\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.thesslstore.com\\\/resources\\\/what-is-an-asv-vulnerability-scan\\\/\",\"url\":\"https:\\\/\\\/www.thesslstore.com\\\/resources\\\/what-is-an-asv-vulnerability-scan\\\/\",\"name\":\"What Is An ASV Vulnerability Scan? - The SSL Store\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.thesslstore.com\\\/resources\\\/#website\"},\"datePublished\":\"2019-07-24T18:15:27+00:00\",\"dateModified\":\"2019-08-07T07:06:54+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.thesslstore.com\\\/resources\\\/#\\\/schema\\\/person\\\/402dded299e19503b088cf48bf165d59\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.thesslstore.com\\\/resources\\\/what-is-an-asv-vulnerability-scan\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.thesslstore.com\\\/resources\\\/what-is-an-asv-vulnerability-scan\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.thesslstore.com\\\/resources\\\/what-is-an-asv-vulnerability-scan\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Resources\",\"item\":\"https:\\\/\\\/www.thesslstore.com\\\/resources\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"PCI Compliance\",\"item\":\"https:\\\/\\\/www.thesslstore.com\\\/resources\\\/category\\\/pci-compliance\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"What Is An ASV Vulnerability Scan?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.thesslstore.com\\\/resources\\\/#website\",\"url\":\"https:\\\/\\\/www.thesslstore.com\\\/resources\\\/\",\"name\":\"The SSL Store\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.thesslstore.com\\\/resources\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.thesslstore.com\\\/resources\\\/#\\\/schema\\\/person\\\/402dded299e19503b088cf48bf165d59\",\"name\":\"tsswordpress\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/78239165ecb118435d2709ba4dd124dd9151b1f6b069f87258c6514fe3728c7e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/78239165ecb118435d2709ba4dd124dd9151b1f6b069f87258c6514fe3728c7e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/78239165ecb118435d2709ba4dd124dd9151b1f6b069f87258c6514fe3728c7e?s=96&d=mm&r=g\",\"caption\":\"tsswordpress\"},\"url\":\"https:\\\/\\\/www.thesslstore.com\\\/resources\\\/author\\\/tsswordpress\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What Is An ASV Vulnerability Scan? - The SSL Store","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.thesslstore.com\/resources\/what-is-an-asv-vulnerability-scan\/","og_locale":"en_US","og_type":"article","og_title":"What Is An ASV Vulnerability Scan? - The SSL Store","og_description":"PCI DSS compliance is a requirement for any organization that accepts payment cards. There are numerous PCI DSS requirements, all aimed at ensuring your customers\u2019 payment care information is kept safe and secure. One of those requirements, 11.2.2, requires external &hellip; Continue reading &rarr;","og_url":"https:\/\/www.thesslstore.com\/resources\/what-is-an-asv-vulnerability-scan\/","og_site_name":"The SSL Store","article_published_time":"2019-07-24T18:15:27+00:00","article_modified_time":"2019-08-07T07:06:54+00:00","author":"tsswordpress","twitter_card":"summary_large_image","twitter_misc":{"Written by":"tsswordpress","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.thesslstore.com\/resources\/what-is-an-asv-vulnerability-scan\/#article","isPartOf":{"@id":"https:\/\/www.thesslstore.com\/resources\/what-is-an-asv-vulnerability-scan\/"},"author":{"name":"tsswordpress","@id":"https:\/\/www.thesslstore.com\/resources\/#\/schema\/person\/402dded299e19503b088cf48bf165d59"},"headline":"What Is An ASV Vulnerability Scan?","datePublished":"2019-07-24T18:15:27+00:00","dateModified":"2019-08-07T07:06:54+00:00","mainEntityOfPage":{"@id":"https:\/\/www.thesslstore.com\/resources\/what-is-an-asv-vulnerability-scan\/"},"wordCount":468,"articleSection":["PCI Compliance"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.thesslstore.com\/resources\/what-is-an-asv-vulnerability-scan\/","url":"https:\/\/www.thesslstore.com\/resources\/what-is-an-asv-vulnerability-scan\/","name":"What Is An ASV Vulnerability Scan? - The SSL Store","isPartOf":{"@id":"https:\/\/www.thesslstore.com\/resources\/#website"},"datePublished":"2019-07-24T18:15:27+00:00","dateModified":"2019-08-07T07:06:54+00:00","author":{"@id":"https:\/\/www.thesslstore.com\/resources\/#\/schema\/person\/402dded299e19503b088cf48bf165d59"},"breadcrumb":{"@id":"https:\/\/www.thesslstore.com\/resources\/what-is-an-asv-vulnerability-scan\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.thesslstore.com\/resources\/what-is-an-asv-vulnerability-scan\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.thesslstore.com\/resources\/what-is-an-asv-vulnerability-scan\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Resources","item":"https:\/\/www.thesslstore.com\/resources\/"},{"@type":"ListItem","position":2,"name":"PCI Compliance","item":"https:\/\/www.thesslstore.com\/resources\/category\/pci-compliance\/"},{"@type":"ListItem","position":3,"name":"What Is An ASV Vulnerability Scan?"}]},{"@type":"WebSite","@id":"https:\/\/www.thesslstore.com\/resources\/#website","url":"https:\/\/www.thesslstore.com\/resources\/","name":"The SSL Store","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.thesslstore.com\/resources\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.thesslstore.com\/resources\/#\/schema\/person\/402dded299e19503b088cf48bf165d59","name":"tsswordpress","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/78239165ecb118435d2709ba4dd124dd9151b1f6b069f87258c6514fe3728c7e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/78239165ecb118435d2709ba4dd124dd9151b1f6b069f87258c6514fe3728c7e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/78239165ecb118435d2709ba4dd124dd9151b1f6b069f87258c6514fe3728c7e?s=96&d=mm&r=g","caption":"tsswordpress"},"url":"https:\/\/www.thesslstore.com\/resources\/author\/tsswordpress\/"}]}},"_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/resources\/wp-json\/wp\/v2\/posts\/1572","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/resources\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/resources\/wp-json\/wp\/v2\/comments?post=1572"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/resources\/wp-json\/wp\/v2\/posts\/1572\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/resources\/wp-json\/wp\/v2\/media?parent=1572"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/resources\/wp-json\/wp\/v2\/categories?post=1572"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/resources\/wp-json\/wp\/v2\/tags?post=1572"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}