Quarterly external vulnerability scans, performed by an ASV, are a fundamental part to achieving and maintaining PCI DSS compliance
Regular ASV scanning helps identify any weaknesses that could lead to a cardholder data breach
Regular ASV scanning provides assurance to your stakeholders and customers that your cardholder environments are well maintained and free of high-risk vulnerabilities
Blackfoot’s ASV scanning service makes vulnerability scanning for PCI DSS compliance simple, no matter how complex your environment might be.
The regular scanning delivered by our ASV service ensures sustainable compliance while highlighting vulnerabilities in your externally facing systems as soon as they occur for rapid remediation.
PCI DSS requires many Level 1 and 2 merchants and service providers to undertake quarterly external vulnerability scans, which must be performed by an Approved Scanning Vendor (ASV). ASVs are approved by the Payment Card Industry Security Standards Council (PCI SSC) to conduct scans for Payment Card Industry Data Security Standard (PCI DSS) compliance purposes.
While ASV scanning is similar to other types of external vulnerability assessments, PCI ASV scans are a crucial to achieving and maintaining PCI DSS compliance by identifying system vulnerabilities that could lead to the compromise of payment card data. These scans contribute to a more secure cardholder data environment and enhance overall cybersecurity.
Blackfoot’s experienced testers employ a logical approach to ASV scanning and help you fix the vulnerabilities we find.
Scope identification
Blackfoot’s Qualified Security Assessors (QSAs) work with you to define the scope of the scan, based on your unique cardholder data environment (CDE).
Scan configuration
Blackfoot’s security testers configure the scanning tools to run against the external perimeter of the identified scope.
Scan execution
Blackfoot runs monthly ASV scans, probing your externally facing systems and networks for potential vulnerabilities, misconfigurations and security weaknesses that could lead to a successful cyber-attack.
Vulnerability assessment
Our scanning tools identify vulnerabilities and provide information about their severity and potential impact on your organisation’s security.
Scan reporting
Our ASV tooling compiles the results into a comprehensive scan report. This report includes details about each identified vulnerability, its severity level, and recommended remediation steps.
Remediation support
Blackfoot’s experienced security testers are on hand to provide advice and support in remediating identified vulnerabilities.
Rescan (if required)
If the initial scan reveals vulnerabilities, your organisation should take steps to remediate them. PCI DSS requires rescanning to confirm that high-risk vulnerabilities have been resolved; something we do at no additional charge.
Attestation of Scan Compliance (ASV Scan Report)
Once you have achieved a passing scan, we will issue an Attestation of Scan Compliance (ASV scan report) to demonstrate compliance with PCI DSS requirements.
Q: What is ASV scanning?
A: ASV scanning refers to external vulnerability scanning conducted by an Approved Scanning Vendor (ASV) as required by PCI DSS. Requirement 11.3.2 of PCI DSS mandates that all external IP addresses and domains within the cardholder data environment, or that could impact its security, are scanned quarterly by an ASV. Blackfoot is an approved ASV, qualified to conduct these scans and issue the passing scan reports required for PCI DSS compliance attestation.
Q: What is an Approved Scanning Vendor (ASV)?
A: An Approved Scanning Vendor is an organisation approved by the PCI Security Standards Council to conduct external vulnerability scanning services as required by PCI DSS. ASVs must meet specific qualification requirements and use approved scanning tools and methodologies. Only ASV-conducted scans are accepted for PCI DSS compliance purposes. Blackfoot holds current ASV approval and our scans are recognised by QSAs and acquiring banks.
Q: How often do we need ASV scans under PCI DSS?
A: PCI DSS requires ASV scans to be conducted at least quarterly. You must also conduct a new scan following any significant changes to your external-facing infrastructure. To achieve a passing scan, all high-severity vulnerabilities identified must be remediated and rescanned before the quarterly deadline. Blackfoot manages the scanning schedule, supports you through any remediation cycles, and issues the passing scan reports required for your compliance records.
Q: What happens if our ASV scan fails?
A: If a scan returns findings that prevent a passing result, you are required to remediate the relevant vulnerabilities and submit to a rescan. The quarterly deadline applies to the passing scan, not the initial scan. Blackfoot supports you through the remediation process and manages rescans efficiently to minimise the impact on your compliance timeline.
Call us on +44 (0) 203 393 7795
*Fill in the fields below
We’ll keep you informed about potential risks and vulnerabilities that could impact your digital assets.