PCI DSS · Requirement 11 · Approved Scanning Vendor

Quarterly Vulnerability
Scans (ASV)

PCI DSS details the security requirements for merchants and service providers that store, process, or transmit cardholder data. To demonstrate compliance with the PCI DSS standard, merchants and service providers are required to perform quarterly Vulnerability Scans, in accordance with PCI DSS Requirement 11.2.

Settings
Definition of the scope and IP addresses to scan
Scan
Quarterly external vulnerability analysis
ASV Report
Results and certificate of compliance
Service

What are ASV scans?

An ASV (Approved Scanning Vendor) scan is an automated vulnerability analysis that examines a company's internet-facing systems, domains, and IP addresses from the outside.

According to PCI DSS requirements, these quarterly scans must be performed by an ASV-certified company on all Internet-accessible components of the compliance environment.

Internet Security Auditors holds this certification, granted by the PCI SSC, and offers a solution that has met the necessary requirements for the vulnerability scans that the PCI SSC demands of affected companies.

Our services

How we work

The main phases of the analysis process consist of:

Scoping
Scanning
Reporting / Remediation
False Positive Resolution
Re-Scanning (if necessary)
Final Report
Scope of testing

What is being analyzed?

In the context of PCI DSS, the "Environment Components" that must be included in quarterly scans include any network component, server, or application that is included in or connected to the cardholder data environment. It also includes any virtualization components such as virtual machines, virtual switches/routers, virtual appliances, virtual applications/desktops, and hypervisors. Network components include, but are not limited to: firewalls, switches, routers, wireless access points, network appliances, and other security devices. Server types include, but are not limited to, the following: web, application, database, authentication, mail, proxy, Network Time Protocol (NTP), and Domain Name System (DNS). Applications include custom or third-party applications, including applications hosted on internal and external systems.

Therefore, the information that must be provided to perform the scan must include IP addresses visible or accessible from the Internet, domains, and the URLs of "hidden" applications or those not directly accessible.

Related Services
PCI DSS Compliance PCI PIN Compliance PCI SSF Compliance PCI 3DS Audit Payment Methods Security

Scope of service

What this service covers

Quarterly external scan

Quarterly vulnerability analysis of all system components with a public IP address included in the PCI DSS environment.

Official ASV Report

Generation of the report certified by a PCI SSC-authorized Approved Scanning Vendor, valid for demonstrating compliance with Requirement 11.

Vulnerability detection

Identification of known vulnerabilities, exposed services, insecure configurations, and outdated software in the external infrastructure.

CVSS Score

Each detected vulnerability is classified according to its CVSS score, allowing remediation to be prioritized based on the actual risk level.

Remediation support

Technical assistance for the remediation of detected vulnerabilities and rescans until a satisfactory compliance result is obtained.

Programming and monitoring

Automated quarterly calendar with reminders, compliance status tracking, and centralized management of all scans.

What our clients say

Organizations that trust us

Working with Internet Security Auditors has been a highly satisfactory experience. Their support in migrating to the ISO/IEC 27001:2022 standard, conducting internal audits, and the PCI DSS certification process has been fundamental in strengthening our information security management system.

Ricardo Andrés Cárdenas Galvis
Information Security Office · Neurona

The strategic support of Internet Security Auditors as CISOaaS has been fundamental in strengthening our internal team. Their expertise perfectly complements our CISO's work and has allowed us to advance more quickly in our cybersecurity maturity.

CISO
RACC

On behalf of Outsourcing SAS BIC, we would like to express our gratitude for your commitment and dedication during the implementation of PCI DSS compliance in our call center. We succeeded in establishing a secure environment in accordance with the most demanding requirements of the payments industry.

Yulian Colmenares
Information Security Office · Outsourcing SAS BIC

Working with Internet Security Auditors has been a positive experience in every respect. Their team combines solid technical expertise with a great willingness to collaborate, which has strengthened our security posture and regulatory compliance.

Andrés Mejía
Head of GRC · Payválida

As CFO of Saint Louis University – Madrid Campus, I have had the opportunity to work with Internet Security Auditors. They have been our indispensable partner in implementing the requirements set forth by GDPR regulations. I would like to highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions…

Victoria Villarreal Palazón
Vice President & Associate CFO · Saint Louis University

As CFO of Fleurop-Interflora Spain, we have been working with Internet Security Auditors for years in the areas of consulting and GDPR compliance. As Interflora is a company 100% oriented toward online commerce, the professional services of Internet Security Auditors provide us with support, security, and the peace of mind that all of our activity is aligned with GDPR compliance.

Francisco Tébar Prada
CFO Southern Europe · Fleurop - Interflora Spain

As CISO at Intaremit S.A., we place the highest importance on logical security. This is not only due to the mere fact that PCI-CPP regulations require us to conduct 4 internal and external vulnerability scans and an annual internal and external pen-test; but also because of the security and peace of mind our company wishes to provide to each and every one of its clients. We have been working and collaborating with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility; for which I recommend them without hesitation.

Sergio Sainz de la Maza
CISO · Intaremit

At Grupo Arbulu, we have worked closely with Internet Security Auditors to implement advanced cybersecurity measures. Thanks to their expertise, we have significantly improved our ability to detect and mitigate cyber risks. Their comprehensive audits and customized solutions have strengthened our security infrastructure, ensuring the protection of our data and the continuity of our operations.

Marcos Montes de Oca
CIO · Arbulu Group

As CEO of Beruby, we worked with Internet Security Auditors when we had to urgently complete a PCI DSS Attestation of Compliance. The entire process was extremely fast, efficient, and professional. Their team provided us with excellent support, demonstrating great technical knowledge and commitment. We undoubtedly recommend their services to any company in need of cybersecurity solutions.

Miguel Acosta
Global CEO · Beruby

At Grupo AR, we highly value the brand protection service provided by Internet Security Auditors for its comprehensive and proactive approach. Their highly qualified team allows us to identify and mitigate risks that could affect the AR Construcciones brand and its various companies.

Nestor Ivan Melo Ballen
Cybersecurity Director · AR Group

FAQ

Frequently Asked Questions

What is an ASV and why is it necessary?

An ASV (Approved Scanning Vendor) is an organization authorized by the PCI Security Standards Council to perform external vulnerability scans. PCI DSS requires these scans to be performed by an ASV to ensure the independence and quality of the analysis.

How often should the scans be performed?

PCI DSS requires a minimum of one scan per quarter (four per year). An additional scan is also required following any significant infrastructure change, such as the installation of new components, changes to the network topology, or major updates.

What happens if the scan detects vulnerabilities?

If the scan result is 'fail', the client must remediate the detected vulnerabilities and request a rescan. Internet Security Auditors provides technical support for remediation and performs rescans until a satisfactory result is obtained.

Can ASV scanning affect production systems?

ASV scans are designed to be non-intrusive and should not affect the normal operation of systems. These are vulnerability assessments, not penetration tests, so the vulnerabilities found are not exploited.

Is Internet Security Auditors an authorized ASV?

Yes. Internet Security Auditors is a company authorized by the PCI Security Standards Council as an Approved Scanning Vendor (ASV), as well as being a QSA (Qualified Security Assessor), which allows us to offer a comprehensive PCI DSS compliance service.

Contact

Do you need ASV scans for your PCI DSS certification?

Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.

R
Ricardo Andrés Cárdenas
2 months ago

Working with Internet Security Auditors has been a highly satisfactory experience. Their support throughout the migration to ISO/IEC 27001:2022 and the PCI DSS certification process has been fundamental in strengthening our ISMS.

A
Andrés Mejía
3 months ago

Your team combines solid technical expertise with a strong willingness for collaborative work, which has strengthened our security posture and regulatory compliance.

V
Victoria Villarreal Palazón
4 months ago

They have been our indispensable partner for the implementation of GDPR requirements. I would highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions.

M
Miguel Acosta
5 months ago

The entire PCI DSS Attestation of Compliance process was extremely fast, efficient, and professional. We undoubtedly recommend your services to any company in need of cybersecurity solutions.

S
Sergio Sainz de la Maza
6 months ago

We have been working with Internet Security Auditors for over 10 years because of their experience, commitment, and approachability. I recommend them without hesitation.

Request information

We will contact you as soon as possible.
Global Presence

Our offices

Barcelona

C. Santander, 101. Building A-2
E-08030 Barcelona (Spain)

+34 93 305 13 18
Madrid

Arequipa St., 1
28043 Madrid (Spain)

+34 91 763 40 47
Bogotá

Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)

+57 601 638 68 88
25
years of experience in cybersecurity
Contact us