After Passing an ASV Scan: What Happens Next?
After passing an ASV scan, here's what to submit, how long results last, and how to set up your next quarterly compliance cycle without gaps.
If you handle credit card data, you’ve likely been told you need a “PCI ASV Scan“. But for many IT managers, the confusion lies in whether a standard internal vulnerability scan is enough or if you specifically require an Approved Scanning Vendor (ASV) to sign off on your reports. You need PCI ASV scanning if your organization processes, stores, or transmits credit card data through any external-facing IP address or web application, and you are required to validate via SAQ A-EP, SAQ B-IP, SAQ C, or SAQ D.
Under PCI DSS 4.0.1, these scans must be performed quarterly by a PCI SSC-approved vendor to secure your Cardholder Data Environment (CDE). Missing this requirement doesn’t just mean a failed audit; it means your merchant bank could revoke your ability to process payments entirely.
ASV (Approved Scanning Vendor): a company on the current PCI SSC list authorised to perform the external vulnerability scans required by PCI DSS 4.0.1.
Low-cost ASV provider: in 2026, defined less by lowest sticker price and more by overall efficiency: fast turnaround, predictable pricing, and built-in support.
Turnaround time: how long between scan submission and receiving your pass certificate or remediation report; ranges from under 24 hours to several days across the market.
CVSS-based validation: scoring findings by the Common Vulnerability Scoring System so flagged issues are prioritised accurately rather than over-reported.
Start your scan with Secusy ASV.
Not every business needs an ASV scan; the requirement is dictated entirely by your SAQ type, which is determined by how you handle transactions. If your systems touch the internet and transmit card data, the PCI SSC mandates an external assessment from a validated third party.
Secusy is built for teams that want low-cost ASV scanning without compromise, under-24-hour turnaround, transparent pricing, hands-on support, and clean, submission-ready reports. Not every business needs an ASV. The requirement is dictated by your Self-Assessment Questionnaire (SAQ) type, which is determined by how you handle transactions. If your systems touch the internet and transmit card data, the PCI Security Standards Council (SSC) mandates an external review from a validated third party.
SAQ A-EP, B-IP, C, and D all require quarterly ASV scanning; SAQ A requires it if your checkout redirects to or embeds a third-party payment page (e.g. Stripe Checkout); only SAQ P2PE via a validated hardware solution is exempt.
SAQ Type | Merchant Profile | ASV Scan Required? |
|---|---|---|
SAQ A | E-commerce/Mail-order outsourced to 3rd party (e.g., Stripe Checkout) | Yes* quarterly, since PCI DSS v4.0.1 |
SAQ A-EP | E-commerce using a direct post or JavaScript integration | Yes |
SAQ B-IP | Standalone IP-connected POI terminals | Yes |
SAQ C | Merchants with payment systems connected to the Internet | Yes |
SAQ D | All other merchants and all Service Providers | Yes |
SAQ P2PE | Hardware payment terminals via a validated P2PE solution | No |
*Applies if your checkout redirects to or embeds a third-party payment page. Fully outsourced merchants where cardholder data never touches your site in any form may still be exempt, confirm with your acquirer.
Every public-facing IP that provides a path into your CDE must be scanned: web servers, firewalls and routers, remote access points, and load balancers.
If you fall into a “Yes” category above, you must scan every public-facing IP address that provides a path into your Cardholder Data Environment (CDE). This includes:
Most first-scan failures come from technical hygiene, not major security gaps, deprecated TLS, verbose server headers, and unnecessary open services top the list.
At Secusy, we frequently see businesses fail their first scan not because of a massive breach, but due to technical hygiene issues that PCI DSS 4.0.1 strictly forbids:
Run a passing scan every 90 days, leave a 2–3 week remediation buffer, attest to the final report, and trigger an extra scan after any significant network or server change.
Secusy ASV strips out enterprise complexity and pricing, focusing only on what SMBs need: fast support, transparent pricing, and no technical bloat.
Most enterprise ASV tools are built for Fortune 500 companies, with pricing and complexity to match. Secusy ASV was designed to solve the “compliance headache” for smaller IT teams and businesses.
Whether you need PCI ASV scanning comes down to one question: does your SAQ type require it? For nearly every merchant handling card data through an internet-facing system, the answer is yes. Once that’s settled, the work is mechanical, scope every external-facing asset correctly, run scans on a fixed 90-day cadence, fix the common hygiene issues before they fail you, and treat significant infrastructure changes as their own trigger. Get that rhythm right, and PCI ASV scanning stops being a compliance question mark and becomes routine.
Start your quarterly ASV scan today with Secusy.
Binoy Koonammavu, is the Founder and CEO of Secusy ASV, where he helps SMBs and fintech companies meet PCI DSS scanning requirements without the complexity of enterprise-grade tools. His writing focuses on making ASV compliance straightforward for growing businesses.