How to Complete a Self-Service PCI ASV Scan in 4 Steps

Getting a PCI ASV scan can involve more admin than you'd expect. Contacting vendors, requesting quotes, confirming requirements and completing paperwork often mean a lengthy back-and-forth process before scanning even begins.

But it doesn't have to be that complicated. With a self-service PCI ASV scan, like those provided by Outpost24, you can skip the lengthy procurement process and manage your PCI ASV scanning online. Simply purchase the licenses you need, set up and run your scan through a self-service portal, and download your Attestation of Scan Compliance report once you've achieved a passing result.

Here's how to complete the process in four simple steps.

Step 1: Purchase Online

Getting started is simple. Visit the vendor's online store and select the number of scanning licenses you need.

Before purchasing, check what each license covers and make sure you've accounted for all the systems that need scanning. For example, you may need multiple licenses to cover different public IP addresses or hostnames.

It's also worth checking what's included in your purchase, such as remediation support, and any additional fees for rescans. This is all included when you buy with Outpost24.

Once you've selected your licenses, complete your purchase securely online. There's no need to request a quote, arrange a sales call, or wait for paperwork. You can buy your scans when you need them and move straight to the setup process.

Step 2: Set Up Your Scan

Once you've purchased your licenses, it's time to set up your scan. Each vendor may be slightly different; with Outpost24, you simply log in to the Outpost24 Portal and follow the onboarding instructions to configure your account and add your scan targets.

You'll need to provide the public IP addresses or hostnames you want to scan. Make sure you've included all internet-facing systems within your PCI DSS scanning scope, as missing a system could leave gaps in your compliance assessment.

You may also need to confirm that you're authorized to scan these systems and check that firewalls or other security controls won't interfere with the scan. Your ASV will provide guidance on any necessary preparations.

Once you have completed onboarding and configured your targets, you can launch your first scan directly from the Portal. The scanning solution will assess your systems for vulnerabilities, without you needing to manage the technical scanning process yourself.

Step 3: Get Your Compliance Report

Once your scan is complete, you can review the results. If your systems meet the PCI ASV scanning requirements, you'll receive a passing result.

You can then download your Attestation of Scan Compliance (AOSC) report, which provides official evidence of your passing scan. Keep this report for your PCI DSS compliance records and share it with your acquiring bank or other compliance-accepting entity if required.

Remember, a passing ASV scan is just one part of PCI DSS compliance. You'll still need to meet your other applicable requirements and complete quarterly ASV scans to maintain compliance.

But what if your scan doesn't pass first time (as happens with most organizations)?

Step 4: If You Don't Pass, Fix and Rescan

If your scan identifies vulnerabilities that prevent a passing result, you can review the findings to see what needs attention.

These might include outdated software, missing security patches or insecure configurations. Once you've identified the problems, take the necessary steps to fix them. If you believe a finding is incorrect, you can also raise a dispute with your ASV for review.

After addressing the issues, launch another scan through the Portal to check that your fixes have worked. With Outpost24's Self-Service PCI ASV Scanning, rescans are included at no extra cost, so you can repeat the process as often as needed until you achieve a passing result.

Once your scan passes, you can download your AOSC report and prepare for your next quarterly scan.

Self-Service PCI ASV Scanning: Frequently Asked Questions

Can I run a PCI ASV scan myself?

Yes. A self-service solution lets you set up and launch your scans without needing technical assistance at every stage. However, to meet PCI DSS requirements, qualifying scans must be performed through a PCI SSC Approved Scanning Vendor (ASV).

How often do I need to run a PCI ASV scan?

Under PCI DSS Requirement 11.3.2, applicable organizations must obtain passing external vulnerability scans at least once every three months. Regular scanning helps identify vulnerabilities before attackers can exploit them.

What happens if my PCI ASV scan fails?

You'll need to review the findings, fix the issues preventing a passing result, and run another scan. You can repeat this process until you achieve a pass. Simply completing a scan isn't enough to satisfy the requirement.

Does passing an ASV scan mean I'm PCI DSS compliant?

No. A passing ASV scan provides evidence towards meeting the external vulnerability scanning requirement, but PCI DSS covers a much broader range of security controls. You'll still need to meet all other requirements applicable to your organization.

Simplify PCI ASV Scanning with Outpost24 Self-Service PCI ASV Scan

Completing your quarterly PCI ASV scanning shouldn't mean navigating a complicated procurement process. With Outpost24, you can purchase your scan online and manage the process through a convenient self-service solution.

Take control of your PCI ASV scanning requirements and get started today.