What is PCI DSS 4.0.1 Requirement 11.3.2?
Requirement 11.3.2 requires external vulnerability scans at least once every three months and after any significant change to the cardholder data environment. Scans must be performed by a PCI SSC Approved Scanning Vendor (ASV) and must produce a passing result.
What is a PCI Approved Scanning Vendor (ASV)?
Our PCI ASV scanning service is provided by an Approved Scanning Vendor, an organization qualified by the PCI Security Standards Council to perform external vulnerability scans for merchants and service providers subject to PCI DSS. Clone Systems has been a PCI SSC listed ASV since 2007, verifiable on the official ASV list.
How often do I need to run a PCI ASV scan?
Requirement 11.3.2 requires external vulnerability scanning at least quarterly (every 90 days) and after any significant change to internet-facing systems in the cardholder data environment. Our portal supports instant scans and automated quarterly scheduling.
What counts as a passing PCI ASV scan?
A passing scan under PCI DSS 4.0.1 has no vulnerabilities scored CVSS 4.0 or higher and no automatic failures defined by the ASV Program Guide. If issues are found, remediate and re-scan until you pass; all re-scans are unlimited and included.
Which systems are in scope for external vulnerability scanning?
All internet-facing IP addresses and fully qualified domain names that are part of, or provide a path into, the cardholder data environment are in scope for Requirement 11.3.2, typically including web servers, mail servers, DNS, firewalls, VPN endpoints, and public-facing application infrastructure.
How does exception handling work under the ASV Program Guide?
Findings can qualify for exceptions (false positives, compensating controls, or disputed CVSS scores) per the ASV Program Guide. Submit in-portal with supporting evidence, get an approval or rejection within 24 hours, and approved exceptions stay attached to future quarterly scans so you do not resubmit each quarter.
Can I schedule PCI ASV scans to run automatically?
Yes. Schedule scans on your preferred quarterly cadence once, and they run on autopilot, keeping you aligned with the 90-day cycle required by Requirement 11.3.2.
Can I run a PCI ASV scan immediately?
Yes. The portal, available in single-tenant or multi-tenant deployments, is built for instant access, letting you launch a scan on demand, useful after a significant change to your environment as required by 11.3.2.
Are unlimited re-scans included?
Yes. Unlimited re-scans are included so you can verify remediation and reach a passing quarterly ASV scan without additional charges.
When do I receive the Attestation of Scan Compliance (AoSC)?
After a passing quarterly ASV scan, Clone Systems issues the AoSC, Executive Summary, Vulnerability Details, and remediation reports required by the ASV Program Guide for your acquirer or QSA.
What reports does the ASV provide after a scan?
Each scan produces the three ASV Program Guide deliverables, the AoSC, the ASV Scan Report Executive Summary, and the ASV Scan Report Vulnerability Details, plus a remediation report with prioritized fix guidance, all downloadable from the portal.
Does an ASV scan replace internal vulnerability scanning?
No. Requirement 11.3.2 covers external scanning by an ASV. Requirement 11.3.1 separately requires internal vulnerability scans at least every three months, performed by qualified internal staff or a third party, not necessarily an ASV. For Requirement 10 logging and monitoring, see our
Requirement 10 guide.
Is a complementary SAQ module included?
Yes. Each account includes a complementary SAQ module to support the broader PCI DSS compliance workflow alongside your quarterly ASV scans.
Do you provide website trust seals?
Yes. Customers can display Clone Systems security trust seals on their websites that tie back to current PCI ASV compliance status.
How can I verify Clone Systems is a listed ASV?
Clone Systems is listed on the official PCI SSC Approved Scanning Vendors page at pcisecuritystandards.org, where acquirers, QSAs, and buyers can independently verify our ASV status.
What happens if my scan fails?
You fix the findings and rescan, as many times as needed, at no charge. If a finding does not apply to your environment, file an exception in the portal and it is reviewed within 24 hours. Support is available 24/7 by email and phone to help you get to a passing scan.
Does a PCI ASV scan count as a penetration test?
No. The ASV scan satisfies Requirement 11.3.2 (quarterly external vulnerability scanning). A penetration test is a separate Requirement 11.4 item that SAQ A-EP, SAQ C, SAQ D and service providers must complete at least annually. SAQ A merchants do not need one. Clone Systems provides both, and the automated external test can start the same day you order.
