ASV Scan Report Sample: An Annotated PCI DSS Walkthrough
Use this ASV scan report sample to read each section: scan dates, CVSS scores, pass/fail rows and root causes. Learn what to fix, then start your ASV scan.
If you’re a US business that handles payment card data in any way, you’ve probably encountered the term “ASV scan” somewhere in a compliance questionnaire, a payment processor’s onboarding email, or a bank’s annual review. It’s easy to assume it only applies to large retailers, but that’s not how PCI DSS actually draws the line.
The real trigger isn’t company size. It’s whether your systems that touch cardholder data are reachable from the public internet. A five-person SaaS startup with a Stripe integration can be just as much in scope as a national retail chain.
This guide breaks down exactly when an ASV scan is required, what the underlying PCI DSS requirement says, how often you need to run one, why scans commonly fail, and what to look for in a provider, so you’re not guessing at compliance obligations or scrambling before a processor’s deadline.
PCI DSS (Payment Card Industry Data Security Standard) is the security standard created by the major card brands (Visa, Mastercard, American Express, Discover, JCB) that any business handling cardholder data must follow. It covers everything from network security to access controls to vulnerability management.
ASV (Approved Scanning Vendor) is a company certified by the PCI Security Standards Council (PCI SSC) to perform external vulnerability scans against a business's internet-facing systems. Only ASV-run scans satisfy the scanning portion of PCI DSS; scans from uncertified tools don't count, even if they check for similar vulnerabilities.
CDE (Cardholder Data Environment) is the set of systems, networks, and processes that store, process, or transmit cardholder data, plus anything connected to them.
Merchant Level is a classification (Level 1 through 4) set by the card brands based on annual transaction volume, which determines how a business validates PCI compliance, but not whether ASV scanning applies in the first place.
Find out in minutes whether your business needs quarterly ASV scanning.
If your business accepts, stores, or passes along card data, even through a third-party processor like Stripe or Square, you're in scope for PCI DSS. The specific validation path (self-assessment questionnaire vs. formal audit) depends on your merchant level, but the underlying security requirements, including scanning, apply broadly.
PCI DSS applies to any US business that stores, processes, or transmits payment card data, regardless of company size, industry, or transaction volume. This includes traditional retailers, but also SaaS platforms billing via card, e-commerce stores on Shopify or WooCommerce, healthcare providers accepting card payments, and nonprofits running card-based donations.
An ASV scan is required whenever cardholder data environment components are internet-facing. It's triggered by exposure, not by revenue or transaction count.
An ASV scan is required when a business has an internet-facing cardholder data environment. In practice, that means: if any system that touches card data, a payment page, an API endpoint, or a server hosting transaction logs has a public IP address or is reachable from the internet, it needs to be scanned by an approved vendor every quarter.
This applies even if a business uses a third-party payment processor, because the surrounding infrastructure (the checkout flow, the servers routing customers to the payment page, admin panels, APIs) is often still in scope. Businesses that are fully outsourced to a payment provider with no card data touching their own systems may qualify for a reduced-scope SAQ that doesn’t require ASV scanning, but this needs to be confirmed with a QSA or the acquiring bank, not assumed.
Requirement 11.3.2 mandates quarterly external scans by an approved vendor with no high-severity vulnerabilities in the passing result, it's the specific rule that makes ASV scanning mandatory, not optional.
Requirement 11.3.2 is the specific clause in PCI DSS that mandates external vulnerability scanning. It states that external vulnerability scans must be performed by a PCI SSC-approved ASV at least once every 90 days, and that scan results must show no vulnerabilities rated 4.0 or higher on the CVSS scale (or equivalent) before the scan can pass. The requirement also covers rescanning: if a scan fails, the business must remediate the flagged issues and rescan until it passes clean. Requirement 11.3.2 sits within PCI DSS’s broader Requirement 11 (“Regularly Test Security Systems and Networks”), alongside internal scanning and penetration testing obligations.
Run a scan at minimum every 90 days, and immediately after any significant change to internet-facing systems in the cardholder data environment.
Quarterly scanning means running a full external vulnerability scan at least once every 90 days, but the clock resets with any significant infrastructure change, not just on a calendar schedule. Adding a new server, opening a new port, changing firewall rules, or launching a new subdomain that touches the CDE can all trigger a need for an additional scan outside the normal quarterly cycle.
Most businesses find it easier to schedule scans on a fixed quarterly calendar (e.g., first week of January, April, July, October) and treat major infrastructure changes as a trigger for an extra, unscheduled scan, rather than trying to track “90 days since last scan” on a rolling basis.
Run a PCI SSC-approved scan with clear, prioritized remediation guidance.
Most failures come from patching and configuration gaps, expired certificates, outdated software, and exposed admin interfaces are the top three across US businesses being scanned.
Scans most often fail because of avoidable, fixable issues rather than deep architectural problems. The most frequent causes include:
Prioritize an ASV with a low false-positive rate, clear remediation guidance, and fast rescan turnaround, the certification itself is table stakes since it's required by the PCI SSC list, not a differentiator.
Choosing an ASV isn’t just about finding a name on the PCI SSC’s approved list; accuracy, support, and turnaround time separate a good provider from a frustrating one. Key factors to weigh:
Secusy combines PCI SSC approval with practical remediation support and fast rescanning, so businesses aren't just getting a compliant scan, they're getting a path to actually passing it.
Secusy is listed on the PCI Security Standards Council’s official Approved Scanning Vendor list, meaning scans run through Secusy satisfy Requirement 11.3.2 directly, no need to layer a certified scan on top of another tool. Beyond certification, Secusy is built around the parts of the process that businesses actually get stuck on: clear, prioritized remediation guidance instead of raw vulnerability dumps, free rescans until a clean pass, and scan turnaround built for teams working against a processor or bank deadline.
An ASV scan becomes mandatory the moment a business has internet-facing systems that handle cardholder data; company size or revenue doesn’t trigger it. PCI DSS Requirement 11.3.2 sets the baseline: scans every 90 days, run by a PCI SSC-approved vendor, with no high-severity vulnerabilities in the final passing result.
Most failed scans trace back to fixable issues like expired certificates and outdated software rather than deep security flaws. Choosing a provider that pairs certification with clear remediation support, like Secusy, makes the difference between a stressful quarterly scramble and a routine compliance task.
Get fast turnaround and free rescans until you pass, with Secusy.
Size doesn't determine the requirement, exposure does. Any business with internet-facing systems touching cardholder data needs quarterly ASV scans, regardless of revenue or transaction volume.
No. An ASV scan is an automated external vulnerability scan required quarterly. A penetration test is a more manual, in-depth assessment typically required annually for higher-risk merchant levels, and the two aren't interchangeable for compliance purposes.
The business must remediate the flagged vulnerabilities and rescan until it achieves a passing result. There's no partial credit, compliance requires a clean passing scan on file.
Not automatically. If any of the business's own infrastructure, checkout pages, APIs, admin panels, is internet-facing and connected to the cardholder data flow, ASV scanning still applies. Fully outsourced setups may reduce scope, but that needs confirmation from a QSA or acquiring bank.
Pricing varies by provider and by the number of IP addresses scanned, typically ranging from a low hundred-dollar range per quarter for small environments to significantly more for larger, multi-IP infrastructures.
Binoy Koonammavu, is the Founder and CEO of Secusy ASV, where he helps SMBs and fintech companies meet PCI DSS scanning requirements without the complexity of enterprise-grade tools. His writing focuses on making ASV compliance straightforward for growing businesses.