Braintree PCI Compliance: Which SAQ Applies and When You Need an ASV Scan
Braintree PCI compliance explained: see which SAQ fits Hosted Fields, Drop-in or custom builds, and when quarterly ASV scans apply. Book an ASV scan today.
Approved Scanning Vendor (ASV): A company certified by the PCI Security Standards Council to run the external vulnerability scans required by PCI DSS. Only ASV-run scans count toward compliance. See the ASV requirements in full.
Attestation of Scan Compliance (AoSC): The signed document is an ASV issue confirming a scan met PCI requirements. Acquirers and merchants keep this on file as proof of quarterly compliance.
Authenticated Scan: A scan run with valid login credentials, so it can check inside an application or system rather than just probing it from the outside. Used less often for external ASV scans, more common in internal vulnerability testing.
Business-as-Usual (BAU): PCI DSS's term for treating vulnerability management as an ongoing operational habit, patching, scanning, monitoring; rather than a one-time compliance event.
Cardholder Data (CHD): Any data printed on or encoded into a payment card: primary account number, cardholder name, expiration date, and service code. Its presence on a system is what triggers PCI scope.
Cardholder Data Environment (CDE): The systems, networks, and processes that store, process, or transmit cardholder data, plus anything connected to them. The scan scope is built around the CDE.
Compensating Control: An alternative safeguard a merchant can implement when they can't meet a PCI requirement exactly as written, provided it addresses the same risk. Must be documented and validated by a QSA.
CVE (Common Vulnerabilities and Exposures): A standardised ID assigned to a publicly known security flaw (e.g., CVE-2024-XXXX). ASV scan reports reference CVEs so you know exactly which vulnerability was found.
CVSS (Common Vulnerability Scoring System): A 0–10 severity score assigned to a vulnerability. PCI DSS requires remediation of anything scoring 4.0 or higher before a scan can pass.
Dispute (Scan Dispute Process): The formal process for challenging a finding you believe is a false positive or not applicable to your environment, submitted through your ASV rather than ignored.
Encryption in Transit: Protecting cardholder data while it moves across a network (e.g., via TLS). A common finding area in ASV scans is weak or outdated encryption protocols.
External Vulnerability Scan: A scan run from outside your network that targets internet-facing IPs and domains; this is what ASV scanning specifically refers to. How this differs from a penetration test.
False Positive: A finding the scan flags as a vulnerability that isn't actually exploitable in your specific setup. Common with compensating controls or misconfigured scan assumptions; disputable through your ASV.
FQDN (Fully Qualified Domain Name): The complete domain name for a host (e.g., shop.example.com). ASV scans are scoped to a list of IPs and FQDNs that make up your external attack surface.
Internal Security Assessor (ISA): An employee trained and certified by the PCI SSC to perform internal PCI DSS assessments for their own organisation, distinct from an external QSA.
Internal Vulnerability Scan: A scan of systems from inside the network. Required by PCI DSS but does not need to be run by an ASV; internal staff or another qualified resource can do it.
IP Range / Scan Scope: The specific external IP addresses and domains submitted for ASV scanning. Getting this list wrong is the single most common cause of incomplete or invalid scans.
Merchant Level A tier (1–4): assigned by card brands based on annual transaction volume. It determines which PCI validation requirements apply, including whether quarterly ASV scanning is mandatory.
Network Segmentation: Isolating the CDE from the rest of the network so fewer systems fall in scope for PCI DSS. Reduces both scan scope and audit burden when implemented correctly.
Non-Authenticated Scan: A scan run without credentials, seeing systems the way an external attacker would. This is the standard mode for ASV scans.
PAN (Primary Account Number): The card number itself; the core piece of cardholder data that PCI DSS exists to protect.
Penetration Test: A manual, adversarial security test attempting to actively exploit weaknesses, distinct from the automated, non-invasive nature of an ASV scan.
PCI DSS (Payment Card Industry Data Security Standard): The security standard published by the PCI SSC that all organisations handling card data must follow. Quarterly ASV scanning is one of its requirements (11.3.2).
PCI DSS v4.0: The current major version of the standard, with updated requirements around scanning, authentication, and encryption. What changed for ASV scanning?
PCI SSC (PCI Security Standards Council): the industry body, founded by the major card brands, that maintains PCI DSS and certifies ASVs and QSAs.
QSA (Qualified Security Assessor): An individual or company certified to conduct on-site PCI DSS compliance assessments, distinct from an ASV, which only performs the scanning component. ASV vs. QSA, explained.
Quarterly Scan Requirement: PCI DSS Requirement 11.3.2: external ASV scans must be run at least once every 90 days, with passing results. Full frequency rules and exceptions.
Remediation: Fixing a vulnerability the scan identified; patching, reconfiguring, or replacing the affected component before the next scan attempt.
Rescan: A follow-up scan run after remediation to confirm the vulnerability is resolved. Most ASVs include a limited number of free rescans per cycle.
Report on Compliance (ROC): The detailed compliance report a QSA produces for Level 1 merchants, distinct from the simpler SAQ used by smaller merchants.
SAQ (Self-Assessment Questionnaire): A self-reported compliance form used by merchants who don't require a full QSA-led assessment. Several SAQ types still require passing quarterly ASV scans.
Scan Failure: When a scan reports one or more vulnerabilities scoring 4.0+ on CVSS, resulting in a non-compliant result until remediated and rescanned. What to do after a failed scan?
Scan Interface: The ASV's portal or dashboard where you configure scan scope, schedule scans, and download reports and attestations.
Scan Report: The detailed technical output of a scan, listing every vulnerability found, its CVSS score, and remediation guidance; the document underlying the AoSC.
Segmentation Testing Verification: (via testing, not just configuration review) that network segmentation actually isolates the CDE as intended.
Service Provider: An entity (not the merchant itself) that stores, processes, or transmits cardholder data on a merchant's behalf, and has its own PCI validation obligations.
Tokenisation: Replacing sensitive card data with a non-sensitive substitute value (a "token") that has no exploitable value if exposed, often used to shrink CDE scope.
Vulnerability Scan: An automated scan that checks systems and applications for known security weaknesses. In the PCI context, this usually refers specifically to the external ASV scan. The full breakdown of what an ASV scan involves.
WAF (Web Application Firewall): A firewall that filters traffic to web applications specifically. Can be used as part of a compensating control but doesn't replace the need for scanning.
Secusy ASV delivers fast turnaround, transparent pricing, and expert support from day one.
Binoy Koonammavu, is the Founder and CEO of Secusy ASV, where he helps SMBs and fintech companies meet PCI DSS scanning requirements without the complexity of enterprise-grade tools. His writing focuses on making ASV compliance straightforward for growing businesses.