11.3 External and internal vulnerabilities are regularly identified, prioritized, and addressed.
This requirement focuses on the regular identification and remediation of vulnerabilities in the organization's systems and network. It ensures that both internal and external vulnerability scans are performed regularly to detect security weaknesses, and that identified vulnerabilities are prioritized and addressed based on their risk level to protect cardholder data from potential exploitation.
Sub-requirements:
11.3. Vulnerability scanning is performed regularly and after significant changes.
Ensure that both internal and external vulnerability scans are conducted regularly and after significant changes, and that vulnerabilities are remediated.
Key Risks
Frequently Asked Questions
How often must vulnerability scans be performed?
Internal and external scans must be performed at least quarterly and after significant changes.
Who can perform external vulnerability scans?
Approved Scanning Vendors (ASVs) must be used for external scans.
How are scan findings remediated?
Findings are tracked, prioritized, and addressed according to risk and compliance requirements.
What happens if a scan fails?
Remediation must occur and a follow-up scan must be performed to verify resolution.
How are scan results documented?
Scan reports and remediation logs are retained as evidence.
Common QSA Questions
Can you provide your vulnerability scan reports and remediation records?
Yes, we maintain all reports and logs of remediation activities.
How do you ensure scans are performed after significant changes?
We tie vulnerability scanning to our change management process.
How are scan findings prioritized and tracked?
We use a risk-based approach and track findings in our vulnerability management system.
Your perspective on this PCI DSS requirement matters! Share your implementation experiences, challenges, or questions below. Your insights help other organizations improve their compliance journey and build a stronger security community.Comment Policy