The ASV's report must include all vulnerabilities found during the scan, even if they were determined to be false positives, out of scope, or remediated prior to a rescan.

• A. False
• B. True
• C. Not specified
• D. N/A

Answer: (B)

In PCI ASV reporting, every vulnerability that the scan discovers must be documented in the report, even if later deemed a false positive, outside of scope, or already remediated before a rescan. This creates a complete, auditable record that auditors can review to verify what was found, how it was classified, and what actions were taken.

Documenting false positives with evidence helps show why a finding isn’t a real risk, while noting out-of-scope items clarifies what was intentionally excluded from the assessment without erasing that the scan did encounter those items. When something is remediated prior to a rescan, the report should reflect the initial finding and then demonstrate that remediation occurred, along with any supporting evidence, so there is traceability from discovery to closure. This comprehensive approach ensures transparency and supports accurate validation of scope, remediation, and overall security posture.