External Network Vulnerability Scanning (ASV)
PCI-DSS Requirement 11.3.2 compliant Approved Scanning Vendor service
Project Description
This project encompasses performing external network vulnerability scanning that is mandatory under PCI-DSS and can only be performed by PCI-approved ASV organizations.
The organization's internet-facing IP addresses, services and web applications are scanned at specific intervals (at least quarterly) to detect security vulnerabilities and produce PASS/FAIL reports in PCI format.
PCI-DSS Requirement 11.3.2 mandates regular ASV scanning of all assets on the external surface and states that results must be verified, false-positive analysis performed, and closure documented with re-scanning.
Project Methodology
ASV scanning process compliant with PCI-DSS standards
External Surface Discovery and Scope
Inventory of all internet-facing IP addresses, domains and services. All external assets within PCI scope are identified.
PCI ASV Approved Scanning
Quarterly scans are performed using scanning tools and methodology approved by the PCI Security Standards Council.
False-Positive Analysis
Identified findings are manually verified. False-positive findings are documented and added to the ASV report.
PASS/FAIL Assessment
Scan results are evaluated according to PCI DSS requirements. For PASS status, all critical and high-level vulnerabilities must be remediated.
Official ASV Report
Official ASV attestation report is prepared in PCI format. Deliverable is provided in format ready for submission to bank or acquiring organization.
Project Benefits
Fulfilling PCI-DSS mandatory requirements
Early detection of critical vulnerabilities on external surface
Ability to submit PASS/FAIL reports to bank/notification authority
Reducing unnecessary effort from false-positives
Providing evidence documentation in compliance audits
Project Process
ASV scanning cycle implemented quarterly
ASV Scanning
Automated scanning with PCI-approved tools
Manual Verification
False-positive analysis and finding verification
Remediation
Vulnerability remediation and re-scanning
ASV Attestation
Official PASS report and documentation
Other PCI-DSS Solutions
Phishing and User Awareness Simulation
Internal Network Vulnerability Scanning and Management
Domain Impersonation and Brand Protection
External Attack Surface Monitoring
TLS and Certificate Compliance Monitoring
Get a Quote for This Solution
Our expert team will contact you and provide a customized quote for your needs
Get a Quote