PCI ASV scanning for BigCommerce stores
BigCommerce hosts the platform and the checkout, but the storefront domain, custom scripts and any servers you run are yours to keep compliant. Here is what a BigCommerce merchant needs to scan under PCI DSS 4.0.1 and how to get it done today.
Do BigCommerce stores need a PCI ASV scan?
BigCommerce is certified as a PCI DSS Level 1 service provider for its platform; the merchant's storefront domain and anything the merchant adds or hosts are outside that certification. A standard BigCommerce store with the hosted checkout usually qualifies for SAQ A.
Since PCI DSS 4.0, SAQ A includes Requirement 11.3.2, so even a fully outsourced checkout needs a passing external scan every 90 days.
Stores using a headless front end, a custom or embedded payment integration, or merchant-run servers in the purchase flow usually move to SAQ A-EP, which adds an annual penetration test.
Your SAQ depends on how your checkout is built. Confirm it with your acquirer or QSA, or use our free SAQ finder.
Which SAQ do BigCommerce merchants usually file?
Standard BigCommerce store, hosted checkout
Quarterly ASV scan of your storefront domain; no pen test.
Headless storefront (Catalyst, Next.js or similar) with BigCommerce checkout
Quarterly ASV scan of every public domain and IP you run, plus an annual penetration test.
Custom or embedded payment integration, or merchant-run servers in the flow
Quarterly ASV scan plus annual penetration test and segmentation testing where applicable.
What the scan looks at on BigCommerce
- Your storefront domain and www subdomain
- Any subdomain you run yourself
- Headless front ends and the servers behind them
- Custom scripts or apps loaded on the storefront
- TLS and certificate configuration on anything you control
Scan results come with an Attestation of Scan Compliance for every passing scan, and rescans are unlimited until you pass.
Why do this now
PCI DSS has already moved once in this direction: version 3.2.1 asked nothing of fully outsourced merchants, and version 4.0 added quarterly ASV scans for them. The standard changes on a multi-year cycle and the changes have added requirements, not removed them. A quarterly scan on your storefront is the lowest-cost way to have a clean scan history ready when your acquirer, bank or a customer asks for it, and it catches the misconfigurations (expired certificates, old TLS, exposed admin paths) that cause most failed scans before they become a problem.
What every PCI ASV scan includes.
The package price is the whole price. Nothing below costs extra.
Unlimited rescans until you pass.
Rescan as many times as it takes, at no charge.
Buy and scan the same day.
No sales call and no onboarding wait; your scan is ready right after checkout.
24/7 support by email and phone.
Call 800-414-0321 any time.
False positives reviewed within 24 hours.
File an exception in the portal and get an answer within a day.
Attestation of Scan Compliance with every passing scan.
The document your bank or QSA asks for, downloadable from your portal.
A listed PCI ASV since 2007.
Your scan comes from the vendor on the PCI Security Standards Council's list, not a reseller of one.
Free trust seal for your website with any scan.
Does your SAQ also require a penetration test?
A quarterly ASV scan covers Requirement 11.3.2. Some SAQs also require an annual penetration test under Requirement 11.4, and most merchants find out from their bank or QSA after the fact.
SAQ A-EP, C or D
A penetration test is required at least annually and after significant changes, plus segmentation testing where you segment.
See what each SAQ requiresNot sure which SAQ you file?
Answer a few questions and get the SAQ, and whether a pen test applies, in under a minute.
Use the SAQ finderAutomated external tests start the same day you order, with retests included for 30 days. Expert-led tests are scoped per environment.
Simple annual pricing for PCI ASV scanning.
Every plan includes unlimited re-scans until you pass, the Attestation of Scan Compliance, and portal access.
Need more than 50 IPs or Domains? Contact us for a custom quote.