11.3.1 Quarterly internal vulnerability scans
Internal vulnerability scans must be run at least every three months. All vulnerabilities ranked high-risk or critical under the entity's risk rankings from Requirement 6.3.1 must be resolved, and rescans must be run to confirm that every such high-risk and critical finding is fixed. The scanning tool must be kept current with the latest vulnerability information, and the people running scans must be qualified and organizationally independent of what they scan. Guidance (good practice): several scan reports may be combined to show full coverage within the three-month cycle, and scanning more often than quarterly is recommended where the environment warrants it. Applicability: a QSA or ASV is not needed for internal scans; qualified internal staff reasonably independent of the scanned components (for example, not the administrator of that network) may run them, or a specialist scanning firm may be used. Objective under the customized approach: automated tools that detect vulnerabilities inside the network periodically verify the security state of every system component, and findings are assessed and fixed using a formal risk assessment framework.
Source: PCI DSS v4.0.1, 11.3.1. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.
Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Four quarters of internal scan reports covering all in-scope system components · Vulnerability scanner / patch tooling
- Scan tool plugin or signature update logs · Vulnerability scanner / patch tooling
periodic reviewEvidence produced at each review
- Rescan reports showing high-risk and critical findings closed · Vulnerability scanner / patch tooling
- Scanner qualifications and evidence of independence from the scanned systems · Vulnerability scanner / patch tooling
governing documentDocuments that govern the control
- Vulnerability risk ranking criteria from Requirement 6.3.1 · Policy repository / GRC workspace
First move
Common gaps auditors find
- A quarter missed or the scan scope omitted some CDE segments
- High or critical findings remain open with no rescan evidence
- Network administrator scans the network they administer
- Scan engine feed not updated for months
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet11.2.2 Inventory of authorized wireless access points · 11.3.1.1 Lower-risk vulnerabilities handled per risk analysis