11.3.1.3External and internal vulnerabilities are regularly identified, prioritized, and addressed

Defined Approach Requirements:

Internal vulnerability scans are performed after any sgnificant change as follows:

- High-risk and critical vulnerabilities (per the entity's vulnerability risk rankings defined at Requirement 6.3.1) are resolved.

- Rescans are conducted as needed.

- Scans are performed by qualified personnel and organizational independence of the tester exists (not required to be a QSA or ASV).

Defined Approach Testing Procedures:

11.3.1.3.a Examine change control documentation and internal scan reports to verify that system components were scanned after any significant changes.

11.3.1.3.b Interview personnel and examine

internal scan and rescan reports to verify that internal scans were performed after significant changes and that high-risk and critical vulnerabilities as defined in Requirement 6.3.1 were resolved.

11.3.1.3.c Interview personnel to verify that internal scans are performed by a qualified internal resource(s) or qualified external third party and that organizational independence of the tester exists.