Become PCI Compliant

Hosts that store cardholder data must be scanned. Also every part of cardholder data system components must be scanned. We recommend you refer to the PCI Data Security Standard (DSS) for details. Check to see these hosts are in your account by going to Assets > Host Assets.

Note: If Asset Group Management Service (AGMS) is enabled for your subscription, you will see the Address Management tab instead of Host Assets. To understand the changes that happen when AGMS is enabled for your subscription, refer to Introducing AGMS.

Yes, our scanners must be able to reach the target hosts being scanned. Go to Help > About to see the IP addresses for external scanners that you'll need to add to your allow list. You'll also see a list of URLs that your scanner appliances must be able to contact for internal scanning.

Problems can arise when scan traffic is routed through the firewall from the inside out, i.e. when the scanner appliance is sitting in the protected network area and scans a target which is located on the other side of the firewall. See Scanning and Firewalls.

Under VM/VMDR, go to Scans > New > Scan and:

1) select the IPs to scan, and

2) select a PCI option profile like "Payment Card Industry (PCI) Options". This profile has scan settings required according to the PCI DSS standard. Learn more about PCI Option Profiles

Run the PCI Technical Report to see whether your scan is compliant. Go to Reports > Templates, hover over the "Payment Card Industry (PCI) Technical Report" and then select Run from the Quick Actions menu.

Looking at your report you'll see the PCI compliance status (PASS or FAIL) for the overall report, for each host and each vulnerability detected. Vulnerabilities with the FAIL status must be fixed to pass the PCI compliance requirements. (Vulnerabilities with no PCI status are not required for compliance, however we do recommend you fix them in severity order.)

After fixing vulnerabilities, be sure to re-scan to verify that all PCI vulnerabilities are fixed and the overall status is PASS.

1) Select PCI from the application picker. Then add a link to a PCI Merchant account (new or existing). You'll use this account for creating your certification report.

2) Select VM from the application picker. Go to Scans, select your external PCI scan from the list, click Share with PCI (in the preview pane), and select the PCI account you've linked to. We'll share (import) the scan to your PCI account. (We'll add to your PCI account any scanned IPs not already in the account.)

3) Select PCI from the application picker. Log in to your PCI account.

4) Now you're ready to create your certification report within PCI. Go to Compliance > Compliance Status, click Generate (under Compliance Status > Actions) and use the report wizard to create your report and submit it to your acquiring banks.

Go to Assets > Asset Groups and create groups that organize your IPs according to your custom PCI risk ranking. Each group will correspond to a risk ranking. Later, after you scan your IPs, you'll create scan reports to verify compliance against your risk ranking.

Under VM/VMDR, go to Scans > New > Scan and:

1) select the asset groups you want to scan (created in the previous step), and

2) select a standard option profile like "Initial Options" or one that you've customized.

The "Payment Card Industry (PCI) Options" is not recommended since this has settings tailored for an external PCI scan and it may increase your scan time significantly.

First create a PCI report template. Go to Reports > Templates and select New > PCI Scan Template. We use the vulnerability risk rankings High, Medium and Low. By default these are set to the same CVSS scores as required for ASV external PCI scans. Under PCI Risk Ranking you need to define a custom risk ranking scale by modifying the CVSS base score ranges for High, Medium and Low ranking vulnerabilities. Be sure to create a template for each ranking scale within your organization.

Then you're ready to create one or more reports, depending on the number of templates you have. To create a report, go to Reports > Templates. Hover over your template, and select Run from the Quick Actions menu.

Review your PCI scan reports. If there are any High ranking vulnerabilities they must be fixed. Be sure to re-scan and re-run your reports to confirm that all High ranking vulnerabilities are fixed.