Our firm processes CC information on an ad hoc basis. No cardholder data is ever recorded in any of our databases and we do not grant public access to any of our database or business application servers either.
None-the-less, we are being levied a PCI non-compliance fee each month. So when I raised this issue our accounting department contacted the service provider and they informed us that we needed to give them permission to perform a security scan.
So, what does this 'scan' test for? other than the non-answer 'compliance, silly'