Our firm processes CC information on an ad hoc basis. No cardholder data is ever recorded in any of our databases and we do not grant public access to any of our database or business application servers either.

None-the-less, we are being levied a PCI non-compliance fee each month. So when I raised this issue our accounting department contacted the service provider and they informed us that we needed to give them permission to perform a security scan.

So, what does this 'scan' test for? other than the non-answer 'compliance, silly'


Based on your description, this sounds like a PCI Approved Scanning Vendor (ASV) scan. This is the program guide that explains more of what an ASV is required to account for: https://www.pcisecuritystandards.org/documents/ASV_Program_Guide_v2.pdf

At a very high level, ASV scans look for certain types of vulnerabilities on Internet-exposed systems. This may include configuration issues, missing patches and other things of that nature.

What they will want to scan are external IP addresses that are part of your Cardholder Data Environment (CDE). Given you do handle credit card data, even though you do not retain the cards, at least some portion of your environment will be considered CDE. The PCI DSS standard, also available on the site above, goes into more detail on scoping a CDE.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.