What is the frequency of external vulnerability scans performed by an Approved Scanning Vendor (ASV)?

• A. Quarterly external vulnerability scans, via an Approved Scanning Vendor (ASV) approved by PCI SSC.
• B. Monthly external vulnerability scans performed by an ASV.
• C. Annually external vulnerability scans performed by an ASV.
• D. Biweekly external vulnerability scans performed by an ASV.

Answer: (A)

External vulnerability scans are required on a quarterly basis by an Approved Scanning Vendor (ASV) approved by PCI SSC. This means the scans are performed roughly every three months from outside the network to identify vulnerabilities on systems that are exposed to the internet. The quarterly cadence keeps pace with evolving threats and changes to externally reachable systems while balancing effort and remediation cycles. Annually is too infrequent to timely catch new or updated vulnerabilities, and biweekly or monthly scans go beyond the mandated minimum cadence (though an organization can choose to do them, the standard specifies quarterly).