The rule: every externally facing system that is in scope
Give the ASV every external-facing IP address and every domain name and other entry point that is part of, or could affect, your cardholder data environment. You define and attest to the scope; the ASV records it on the attestation; you are responsible for anything left out. Segmentation is how you take something out of scope, and you must be able to show it.
What to include (checklist)
- The public IP addresses of every server that handles or can reach cardholder data.
- Every domain and subdomain that serves your store, checkout, admin, API or customer portal.
- Every name-based virtual host on a shared IP.
- Mail servers for in-scope domains.
- DNS servers you run yourself.
- Hidden or unlinked URLs that still serve payment-related pages.
- Hosts that redirect visitors into the payment flow.
- Any load balancer IP and, unless the systems behind it are confirmed identical, the IPs behind it.
- Staging or development copies that are reachable from the internet.
What the ASV checks on its own
The ASV Program Guide requires the ASV to validate the scope. Clone Systems does this on every scan:
- Resolve the IPs behind each domain you give.
- Perform forward and reverse DNS lookups of common hostnames (www, mail, admin, api, shop).
- Look up MX records for mail hosts.
- Check redirects from your in-scope web servers to IPs you did not list.
- Identify domains found while crawling that you did not supply.
Anything found is raised with you before the report is final; scoping discrepancies are noted on the attestation.
Special cases
Shared hosting
Your host scans its ranges and provides proof, or your scan covers your hosted environment.
Load balancers
Provide documented assurance that the systems behind the load balancer are configuration-synchronized. Otherwise the report notes they need internal scanning. See our guide to load balancers and PCI ASV scanning.
CDNs such as Cloudflare
The hostname is in scope; the origin is in scope if reachable from the internet. See how to get a valid ASV scan behind Cloudflare.
Hosted platforms (Shopify, BigCommerce)
Include your storefront domain and anything you run. The platform's infrastructure is covered by the platform's own certification. See the Shopify PCI scanning guide and BigCommerce PCI scanning guide.
IPv6
If a host answers on IPv6, that address is in scope too.
How to take something out of scope
Use segmentation that you can evidence, such as firewall rules, a separate network and no path to cardholder data, or decommission the system and clean up DNS. The Guide's rule is that once an address has been in a scan it stays in scope for at least one more quarter after you say it is released, so clean up DNS and tell the ASV early.
Mistakes that get a scan questioned
- Listing the www domain but not the bare domain, or vice versa.
- Forgetting the admin subdomain.
- A decommissioned server still in DNS.
- Scanning the CDN hostname and forgetting a directly reachable origin.
- A second data center or region behind global load balancing.
- A staging copy on a public IP.
- A mail server for the store domain.
Related guides
Does your SAQ also require a penetration test?
A quarterly ASV scan covers Requirement 11.3.2. Some SAQs also require an annual penetration test under Requirement 11.4, and most merchants find out from their bank or QSA after the fact.
SAQ A-EP, C or D
A penetration test is required at least annually and after significant changes, plus segmentation testing where you segment.
See what each SAQ requiresNot sure which SAQ you file?
Answer a few questions and get the SAQ, and whether a pen test applies, in under a minute.
Use the SAQ finderAutomated external tests start the same day you order, with retests included for 30 days. Expert-led tests are scoped per environment.