PCI DSS v4.0/Requirement 11: Test Security of Systems and Networks Regularly/202 of 250
11.3.2.1External and internal vulnerabilities are regularly identified, prioritized, and addressed
Control family: Requirement 11: Test Security of Systems and Networks Regularly
Control description
Defined Approach Requirements:
External vulnerability scans are performed after any significant change as follows:
- Vulnerabilities that are scored 4.0 or higher by the CVSS are resolved.
- Rescans are conducted as needed.
- Scans are performed by qualified personnel and organizational independence of the tester exists (not required to be a QSA or ASV).
Defined Approach Testing Procedures:
11.3.2.1.a Examine change control documentation and external scan reports to verify that system components were scanned after any significant changes.
11.3.2.1.b Interview personnel and examine external scan and rescan reports to verify that external scans were performed after significant changes and that vulnerabilities scored 4.0 or higher by the CVSS were resolved.
11.3.2.1.c Interview personnel to verify that external scans are performed by a qualified internal resource(s) or qualified external third party and that organizational independence of the tester exists.