11.2.2 Are quarterly external vulnerability scans performed? Review results from the four most recent quarters of external Note: Quarterly external vulnerability scans must be vulnerability performed by an Approved Scanning Vendor (ASV), approved by the Payment Card Industry Security Standards Council (PCI SSC). Refer to the ASV Program Guide published on the PCI SSC website for scan customer responsibilities, scan preparation, etc. Do external quarterly scan and rescan results satisfy Review results of each external the ASV Program Guide requirements for a passing quarterly scan and rescan scan (for example, no vulnerabilities rated 4.0 or higher by the CVSS, and no automatic failures)? Are quarterly external vulnerability scans performed by Review results of each external a PCI SSC Approved Scanning Vendor (ASV? quarterly scan and rescan 11.2.3 Are internal and external scans, and rescans as Examine and correlate change needed, performed after any significant change? control documentation and scan reports Note: must be performed by qualified personnel. Does the scan process include rescans Review scan reports For external scans, no vulnerabilities exist that are scored 4.0 or higher by the CVSS, For internal scans, a passing result is obtained or all vulnerabilities as “high-risk” defined in PCI DSS Requirement 6.1 are resolved? Are scans performed by a qualified internal resource(s) Interview personnel or qualified external third party, and if applicable, does organizational independence of the tester exist (not required to be a QSA or ASV)? 11.3.4 If segmentation is used to isolate the CDE from networks:
11.2.2 Are quarterly external vulnerability scans performed? Note: Quarterly external vulnerability scans must be performed by an Approved Scanning Vendor (ASV), approved by the Payment Card Industry Security Standards Council (PCI SSC). Refer to the ASV Program Guide published on the PCI SSC website for scan customer responsibilities, scan preparation, etc. Review results from the four most recent quarters of external vulnerability Do external quarterly scan and rescan results satisfy the ASV Program Guide requirements for a passing scan (for example, no vulnerabilities rated 4.0 or higher by the CVSS, and no automatic failures)? Review results of each external quarterly scan and rescan Are quarterly external vulnerability scans performed by a PCI SSC Approved Scanning Vendor (ASV? Review results of each external quarterly scan and rescan 11.2.3 Are internal and external scans, and rescans as needed, performed after any significant change? Note: must be performed by qualified personnel. Examine and correlate change control documentation and scan reports Does the scan process include rescans For external scans, no vulnerabilities exist that are scored 4.0 or higher by the CVSS, For internal scans, a passing result is obtained or all “high-risk” vulnerabilities as defined in PCI DSS Requirement 6.1 are resolved? Review scan reports Are scans performed by a qualified internal resource(s) or qualified external third party, and if applicable, does organizational independence of the tester exist (not required to be a QSA or ASV)? Interview personnel 11.3.4 If segmentation is used to isolate the CDE from networks:
SAQ_C.docx