How often must internal and external vulnerability scans be performed?

How often must internal and external vulnerability scans be performed?

• A. Annually
• B. Quarterly
• C. Monthly
• D. Weekly

Answer: (B)

Regular vulnerability scanning is set to a quarterly cadence to ensure ongoing identification and remediation of weaknesses in the cardholder data environment. Both internal and external scans must occur at least every three months, with the external scans performed by an Approved Scanning Vendor for Internet-facing systems and internal scans conducted by your own tools to check internal configurations and patches. If there are significant changes to the network or new systems added, you should re-scan promptly in addition to the quarterly schedule. An annual interval would miss too many new vulnerabilities, while monthly or weekly scans go beyond the required minimum. Therefore, quarterly is the correct minimum frequency.

Regular vulnerability scanning is set to a quarterly cadence to ensure ongoing identification and remediation of weaknesses in the cardholder data environment. Both internal and external scans must occur at least every three months, with the external scans performed by an Approved Scanning Vendor for Internet-facing systems and internal scans conducted by your own tools to check internal configurations and patches. If there are significant changes to the network or new systems added, you should re-scan promptly in addition to the quarterly schedule. An annual interval would miss too many new vulnerabilities, while monthly or weekly scans go beyond the required minimum. Therefore, quarterly is the correct minimum frequency.