The PCI SSC's Quality Assurance Program stipulates that quality assurance testing of ASV services and reporting, including validation via the ASV Validation Test Bed, must happen annually.

• A. TRUE
• B. FALSE
• C. NEVER
• D. SOMETIMES

Answer: (A)

Annual QA testing cadence is what this item focuses on. The PCI SSC Quality Assurance Program requires that quality assurance testing of ASV services and their reporting, including validation through the ASV Validation Test Bed, be performed every year. This annual cycle ensures that scanning engines, detection logic, reporting formats, and data outputs stay accurate and aligned with PCI DSS expectations despite updates to software, vulnerability definitions, or processes. The ASV Validation Test Bed provides a standardized baseline to verify that the ASV’s results and risk ratings remain consistent with those standards, so regular annual validation helps prevent drift and maintains trust in the ASV’s assessments. In short, the statement is true because maintaining established accuracy and reliability through yearly QA and validation is the defined practice.