The scan looks at your website, servers and network from the outside, the way an attacker would, and checks for known weaknesses that could expose cardholder data. A passing scan is one of the pieces of evidence you submit to your bank or payment processor to show you are PCI compliant.
Clone Systems has run PCI compliance scans as a PCI SSC Approved Scanning Vendor since 2007. This guide explains what the scan is, who needs it, what it checks, and what happens when it fails.
Who needs a PCI compliance scan?
Any business that stores, processes or transmits payment card data, and has systems reachable from the internet, needs quarterly ASV scans. That covers most online stores, hosted checkout pages, booking systems, and any service provider that touches card data for its customers.
Which PCI DSS Self-Assessment Questionnaire (SAQ) you complete decides whether the scan applies to you. Under PCI DSS v4.0.1 the ASV scan requirement (11.3.2) is included in:
- SAQ A: ecommerce and mail or phone order merchants who fully outsource card handling. No penetration test, but ASV scans are required.
- SAQ A-EP: ecommerce merchants whose own website affects how the payment page loads.
- SAQ B-IP, SAQ C, SAQ C-VT: merchants using internet-connected payment terminals or virtual terminals.
- SAQ D: merchants and service providers who do not fit a simpler SAQ.
SAQ B (dial-out terminals only) and SAQ P2PE (validated point-to-point encryption) do not include the ASV scan requirement.
Not sure which SAQ applies to you? Use the PCI SAQ Finder.
Clone Systems is an Approved Scanning Vendor, not a Qualified Security Assessor. Your acquiring bank or payment processor confirms which SAQ and reporting level apply to your business.
What does a PCI compliance scan check?
The scan tests every internet-facing IP address or domain you put in scope. It does not need software installed, a login, or access to your internal network. From the outside, it looks for:
- Open ports and services that should not be exposed to the internet
- Outdated software with known vulnerabilities, including web servers, frameworks and content management systems
- Weak or expired SSL/TLS encryption on your website and other services
- Common web application weaknesses such as SQL injection and cross-site scripting
- Misconfigurations, default settings and exposed admin interfaces
- Known malware or signs of compromise on public-facing systems
Each finding is rated using the Common Vulnerability Scoring System (CVSS). The ASV Program Guide sets the pass line: any vulnerability scored 4.0 or higher fails the scan, and a short list of issues fails it automatically regardless of score.
An ASV scan is not a penetration test. The scan is automated and looks for known weaknesses. A penetration test is a person actively trying to break in. PCI DSS asks for both at different points, and for most merchants the quarterly scan is the one that comes up first.
How often do you need a PCI scan?
PCI DSS v4.0.1 sets two triggers:
- Every three months (Requirement 11.3.2). You need a passing ASV scan for each quarter, and the four passing scans in a year are what your SAQ asks you to confirm.
- After any significant change (Requirement 11.3.2.1). A new server, a website rebuild, a new payment integration or a major software upgrade means you scan again, outside the quarterly cycle.
Quarterly is the minimum. Clone Systems recommends scanning monthly. New vulnerabilities are published every week, and a monthly scan means you find and fix them before the quarterly scan that counts, instead of scrambling against a deadline. Rescans are included with every Clone Systems PCI ASV plan, so scanning more often costs nothing extra.
Pass or fail: what the result means
Every ASV scan ends in one of two results.
Pass. No vulnerability at CVSS 4.0 or above and none of the automatic-failure conditions were found. You receive an Attestation of Scan Compliance (AoSC) and a scan report. The attestation is the document your bank or processor asks for. It carries the organization name you registered the scan under, so make sure that name matches your merchant account.
Fail. At least one finding crossed the line. The report lists each failing item, which system it was found on, how it was rated, and what to do about it. A failed scan is not a penalty and nothing is reported to anyone. It means you have work to do before the quarterly deadline.
Failing a first scan is common, especially for businesses scanning for the first time or after a website change. What matters is fixing the findings and getting a passing rescan before the end of the quarter.
What to do after a failed PCI scan
There are three ways a failing item gets cleared.
- Fix it and rescan. Patch the software, close the port, update the certificate, or change the setting the report points to. Then run the scan again. With Clone Systems, rescans are included, so you can rescan as many times as it takes.
- Dispute a false positive. Sometimes the scanner flags something that is not actually a risk, such as software that has been patched but still reports an old version number. You submit an exception with evidence, and the ASV's security team reviews it. At Clone Systems, exceptions are submitted in the portal under Options and are typically reviewed within 24 hours. Once accepted, the exception stays attached to that scan so you do not have to resubmit it.
- Document a compensating control. If a finding cannot be fixed, you can document the other controls that reduce the risk. The ASV reviews whether the compensating control is enough for the scan to pass.
For a step-by-step walkthrough, see What to do when you fail a PCI scan.
Who is allowed to run the scan?
Only a PCI SSC Approved Scanning Vendor. Running a vulnerability scanner yourself, or using a scanning tool that is not on the approved list, does not satisfy Requirement 11.3.2. The scan has to be performed by an ASV whose scanning solution is tested and approved by the PCI Security Standards Council every year.
You can check any vendor on the PCI SSC's list of Approved Scanning Vendors. Clone Systems has been on that list since 2007.
Many security companies publish guides to PCI scanning and sell vulnerability scanning tools without being an ASV. Their scans may be useful for your own security, but they will not produce an Attestation of Scan Compliance your bank will accept. If a vendor cannot show you their listing on the PCI SSC site, their scan is not a PCI compliance scan.
More on what an ASV does and how to choose one: What is a PCI Approved Scanning Vendor?
How to get a PCI compliance scan
With Clone Systems the whole process is online and self-managed.
- Buy the scan. Choose the plan for the number of IP addresses or domains you need to scan on the PCI ASV scanning page. The organization name you enter at checkout is the name that appears on your Attestation of Scan Compliance.
- Log in to the portal. Your scanning account is created automatically when the order completes. Add your targets. If your IP addresses change, you can scan by domain instead so the exception history stays attached to your scan.
- Run the scan. Run it on demand or schedule it. Quarterly is required; monthly is what we recommend.
- Review the report. Each finding comes with plain-language remediation guidance. Fix what needs fixing, submit exceptions for false positives, and rescan. Rescans are included.
- Download your attestation. When the scan passes, download the Attestation of Scan Compliance and scan report from the portal and send them to your bank or processor.
For what the scan costs and how pricing works, see PCI scan cost in 2026, or go straight to pricing.
Frequently asked questions
Is a PCI scan the same as an ASV scan?
Yes. PCI scan, PCI compliance scan, PCI vulnerability scan and ASV scan all refer to the external vulnerability scan PCI DSS Requirement 11.3.2 asks for, performed by an Approved Scanning Vendor.
What is the difference between a PCI scan and a vulnerability scan?
A PCI scan is a vulnerability scan with extra rules. It must be run by an ASV, it is scored against the PCI SSC's pass and fail criteria, and it produces an attestation your bank will accept. A general vulnerability scan can use any tool and has no pass line.
How often is a PCI scan required?
At least every three months, plus after any significant change to your systems. Clone Systems recommends monthly so problems are found before the quarterly scan that counts.
What fails a PCI scan?
Any vulnerability rated CVSS 4.0 or higher, plus a short list of automatic failures such as exposed cardholder data, known malware, or vulnerabilities in remote access software. The scan report lists every failing item and how to fix it.
Do I need an internal PCI scan too?
PCI DSS also requires quarterly internal vulnerability scans (Requirement 11.3.1), but those do not have to be run by an ASV. Clone Systems offers internal scanning as a separate service.
Can I run a PCI scan myself with free software?
You can scan your own systems with any tool you like, and it is a good idea. But it does not satisfy Requirement 11.3.2. Only a scan performed by an Approved Scanning Vendor counts, and only an ASV can issue the Attestation of Scan Compliance.
What is a PCI scan tool?
Usually this means the scanning platform an ASV provides: a portal where you add your IP addresses or domains, run scans, read reports and download your attestation. Clone Systems' platform does all of this, with AI remediation guidance on every finding.
How long does it take to get compliant after a failed scan?
It depends on the findings. Many fixes, such as updating a certificate or closing a port, take minutes, and you can rescan right away. The important deadline is the end of the quarter.