PCI ASV Certification: How It Differs From PCI Certified and PCI Compliant
PCI ASV certification explained: how it differs from PCI certified and PCI compliant, who validates each, and how to verify a PCI approved scanning vendor.
A PCI ASV rescan is what stands between a failing scan and a compliance report your bank will actually accept, and it’s also where most compliance timelines quietly go sideways. Your initial scan flags a vulnerability, remediation takes a little longer than planned, and suddenly you’re staring at a second or third rescan attempt with no idea whether it’s free, billed, or running you up against your quarterly deadline.
None of that is unusual. Failing a first scan is common, not a red flag for your business. What separates a smooth compliance cycle from a stressful one is knowing exactly how the rescan process works, what it costs when it isn’t bundled in, and how many attempts a reasonable ASV should give you before asking you to pay again. This guide covers all three, in plain terms, so you’re planning around the rescan process instead of getting surprised by it.
PCI ASV Rescan: A follow-up external vulnerability scan performed by a PCI SSC-approved Approved Scanning Vendor (ASV) after an initial scan returns a failing result, confirming that previously identified vulnerabilities have been resolved.
Approved Scanning Vendor (ASV): A company qualified by the PCI Security Standards Council to perform external vulnerability scans under PCI DSS Requirement 11.3.2. Only scans from a listed ASV count toward compliance.
CVSS Score: The Common Vulnerability Scoring System rating assigned to each finding. Under PCI DSS, any finding with a CVSS base score of 4.0 or higher is a failing condition that must be remediated.
Attestation of Scan Compliance (ASC): The document your ASV issues once you achieve a passing scan; this is what your acquirer or QSA reviews, not the failed report.
False Positive Dispute: A formal process for challenging a finding you believe doesn't represent real risk in your specific environment. An accepted dispute can clear a scan without remediation or a rescan.
Retest Fee: A per-scan charge some vendors apply for each rescan requested beyond what's included in the base plan.
A rescan is required any time your external scan returns a failing result, specifically, when one or more findings score 4.0 or higher on the CVSS scale on an in-scope IP address or domain.
PCI DSS Requirement 11.3.2 is unambiguous here: external scans must be run by a PCI SSC-approved ASV, and they must pass before contributing to a valid compliance attestation. A failing result isn’t a paperwork issue; it’s evidence that your external attack surface has an exploitable gap, and the rescan exists to verify that gap is actually closed, not just addressed on paper.
It’s worth noting that a rescan submitted before remediation is genuinely complete will almost always fail again, the ASV is checking the same IP, port, and vulnerability signature from the original finding, not giving you the benefit of the doubt.
No retest fees, no surprise invoices, remediation cycles are covered from the first quarter.
You remediate the flagged finding, submit a rescan request through your ASV's portal, and the vendor rechecks either the specific finding or your full scope, depending on their policy, before issuing your Attestation of Scan Compliance.
The mechanics are consistent across most vendors:
Some vendors distinguish between a targeted rescan, checking only the systems tied to the original findings, and a full rescan, which reruns your entire scope. Targeted rescans are usually faster and sometimes priced differently, so it’s worth asking which one your provider runs by default. Most responsive ASVs turn a rescan around within a day or two, which matters if your quarterly window is closing.
When rescans aren't bundled into your plan, expect somewhere between $15 and $75 per attempt, and in some cases, pricing close to a full new scan. Bundled plans fold the ASV rescan cost into the base subscription, so no separate charge appears.
Rescan pricing tends to follow one of three patterns:
The real cost of ASV compliance isn’t the headline scan price; it’s that price plus however many rescans your environment ends up needing. A cheaper base quote with per-rescan fees can outspend a slightly higher quote with rescans included, especially on a first-time scan.
There's no PCI SSC mandate here; it's entirely vendor-defined. Secusy ASV includes 6 free rescans per quarter with every plan, which covers the large majority of remediation cycles without triggering an additional charge.
A few factors shape how many rescans you’ll actually need:
If you exhaust your included rescans, that typically doesn’t mean you’re locked out of compliance; most vendors will run an additional scan for a fee, or you can wait for the next quarterly cycle if your timeline allows.
Compare per-IP, subscription, and annual ASV pricing models side by side before you commit.
Sometimes. If you can show that a flagged finding doesn't represent a real risk in your specific environment because of a compensating control or a technically inaccurate finding, you can file a false positive dispute. An accepted dispute can clear the scan without remediation or a rescan at all.
This isn’t a loophole; it’s a built-in mechanism in the PCI SSC’s ASV Program Guide that accounts for the fact that not every theoretical vulnerability is exploitable in every configuration. Used correctly, it can save time and an unnecessary rescan cycle, but it requires solid evidence, and your ASV must formally review and accept it.
Missing a passing scan inside the required 90-day window is a compliance gap your acquirer or QSA will flag, even if you were actively working through rescans. It's not usually an automatic penalty, but it does need to be documented and explained.
This is the real reason rescan allowance matters more than people expect going in. It’s not about dodging a small retest fee; it’s about having enough attempts left to close the quarter cleanly before the deadline passes.
Failing a scan is normal; what determines whether your compliance cycle stays on track is your PCI ASV rescan policy, how many attempts are included, what an extra one costs, and how fast your provider turns them around. Some vendors bill per retest, some cap free rescans at just one or two, and some build a generous allowance into the base price from day one. Before you commit to an ASV, get a straight answer on rescans, not just the headline scan price. Secusy ASV includes 6 free rescans per quarter, works with the false positive dispute process where it genuinely applies, and is listed on the PCI SSC Approved Scanning Vendor directory, so remediation cycles get resolved inside your compliance window, not outside it.
Talk to a PCI ASV specialist about your remediation timeline before your next scan is due.
A failing initial scan result: specifically, any finding with a CVSS base score of 4.0 or higher on an in-scope IP or domain.
It depends on your provider's rescan policy. Some include a set number of free rescans per quarter; others charge a retest fee per attempt.
There's no fixed standard; offerings range from zero to unlimited. Secusy ASV includes 6 free rescans per quarter with every plan.
Usually a similar window to the original scan; a few hours to run, with results typically available within 24–48 hours, depending on scope and provider queue.
Yes, if accepted. A successful dispute clears the finding without remediation or a rescan, though it requires evidence and formal ASV review.
No. The quarterly requirement is about running a scan every 90 days; a rescan is a remediation check tied to a specific failed result, not a replacement for that quarterly scan.
Depends on the vendor. A targeted rescan checks only the affected systems; a full rescan reruns your entire scope. Ask which one applies before you assume.
Fully remediate every flagged item; patch, reconfigure, or adjust firewall rules as needed, and confirm the fix is live before resubmitting. Requesting a rescan before remediation is complete usually just produces another failure, and sometimes another retest fee.
Binoy Koonammavu, is the Founder and CEO of Secusy ASV, where he helps SMBs and fintech companies meet PCI DSS scanning requirements without the complexity of enterprise-grade tools. His writing focuses on making ASV compliance straightforward for growing businesses.