In the strictest sense the safest thing to do is to, of course,
As you've no doubt found this can be difficult in a distributed environment. The specific vulnerability scanning tool you use can also add in some problems. Take Nessus for example. When building a scan profile there is an option called, "Check for PCI-DSS compliance." This makes a bunch of internal changes to the scan profile to meet the muster they've defined. However, this also requires there be no network protections between the scanner and the device. So no firewalls, no IDPs, hell they don't even want any routers involved.
Going back to the conceptual level, keep these kinds of problems in mind as you're building out your infrastructure. Here are the design features that I would start with, presented as a bulleted list in no particular order.
- Remote scanner housed at each site
- Centralized system to pull reports from all remote scanners for processing
- Vulnerability management process to
- Review reports
- Analyze results for false/true positives
- Define actionable items
- Prioritize items
- Determine remediation/mitigation paths for each items
So yes, this type of a program comprises both technical and procedural aspects that must work in tandem. Additionally, the process for reviewing and handling the reports must include representatives from all involved units. Primarily whomever is involved in managing the endpoints, the terminals, servers, etc. May also include the groups responsible for managing the networking, internal customers outside of IT who actually use the system, or others as fit within your environment.