The pci dss asv list is a publicly available directory of organizations certified by the Payment Card Industry Security Standards Council (PCI SSC) to perform external vulnerability scans for entities processing cardholder data. These vendors are authorized to conduct assessments that validate compliance with specific PCI DSS requirements related to network security.
ASVs, or Approved Scanning Vendors, are independently audited and approved by the PCI SSC to ensure their scanning tools meet strict technical and procedural standards. Their role is to identify known vulnerabilities in systems exposed to the internet, such as open ports, outdated software, and misconfigured firewalls. The results are reported to the merchant or service provider's acquirer, who then determines whether the entity meets PCI DSS requirements.
Organizations must complete a scan by an ASV on a quarterly basis if they are in scope for PCI DSS. The scan is required regardless of internal security controls, because external threats often exploit publicly accessible systems. Failure to maintain valid scan results can result in non-compliance status, increased risk of data breaches, and potential fines from card brands.
When a business processes, stores, or transmits cardholder data, it must comply with the PCI DSS structure. Requirement 11.2 specifically mandates that external vulnerability scans be performed by an approved vendor. The scan is conducted remotely against the organization's public-facing IP addresses and services.
ASVs use standardized scanning tools that follow the PCI SSC's Technical Requirements for ASVs. These tools are updated regularly to detect newly discovered vulnerabilities, including those listed in the Common Vulnerabilities and Exposures (CVE) database. The scan runs automated tests based on predefined checklists, such as checking for unpatched operating systems, weak encryption protocols, or default credentials.
After completion, the ASV generates a detailed report that includes findings, severity levels, and remediation guidance. This report is submitted directly to the acquiring bank or payment processor, which verifies the results. A clean scan-no critical or high-risk findings-confirms that the system met the minimum security threshold for the quarter.
ASVs are categorized by the level of access they require and the complexity of the systems they assess. Not all ASVs are qualified to scan every environment. The PCI SSC maintains a tiered model based on the sensitivity of the data and the architecture of the network.
| ASV Type | Scope of Assessment | Typical Clients |
|---|---|---|
| Level 1 | External-only scans of public IP ranges | Merchants with fewer than 20,000 annual transactions |
| Level 2 | Scans of systems with direct internet exposure | Service providers and merchants above Level 1 thresholds |
| Level 3 | Scans involving complex architectures or multiple networks | Large enterprises, cloud-based platforms, multi-site operations |
For example, a small e-commerce store processing 15,000 transactions annually would fall under Level 1. Its ASV would only scan externally facing web servers and payment gateways. A large financial institution with multiple data centers and cloud-hosted applications would require a Level 3 ASV capable of handling segmented networks and changing IP environments.
Non-compliant scanning-using a vendor not on the official pci dss asv list-invalidates the entire compliance effort. Even if internal teams fix all issues, the absence of a valid ASV report means the organization cannot claim compliance with Requirement 11.2.
Many organizations assume that running a free online scanner, such as those offered by public security tools, satisfies PCI DSS requirements. This is incorrect. Only scans performed by a vendor on the official pci dss asv list are accepted by card brands and acquirers.
Another misconception is that ASV scans replace internal security testing. They do not. Internal penetration tests, configuration audits, and ongoing monitoring remain essential. An ASV scan detects only publicly exposed vulnerabilities. It cannot assess physical security, employee access controls, or application logic flaws.
A key distinction: ASV scans are passive. They do not attempt to exploit vulnerabilities. They only detect open ports, known weak configurations, and outdated software. Exploitation testing requires a different type of assessment, typically performed by a Qualified Security Assessor (QSA).
One non-obvious fact: the pci dss asv list is updated monthly. New vendors are added after passing rigorous validation, and existing ones may be removed if they fail audits. The current list is published on the PCI SSC website and includes over 100 active ASVs globally. As of 2024, 62% of ASVs are based in North America, 23% in Europe, and 15% in Asia-Pacific regions.
In Q2 2024, a regional retail chain with 12 stores and a central payment processing server engaged an ASV from the pci dss asv list to fulfill its quarterly compliance obligation. The chain had previously experienced a breach due to an unpatched web server, so leadership prioritized external scanning.
The selected ASV, a Level 2 vendor with ISO 27001 certification, scanned the company's public IP range and identified three high-risk findings: an outdated version of Apache HTTP Server (v2.4.29, known to have remote code execution vulnerabilities), an open SSH port with password authentication enabled, and a missing firewall rule allowing ICMP traffic from untrusted sources.
The ASV generated a report with evidence, including timestamps and packet captures. The report was sent to the acquiring bank. The retailer's IT team patched the Apache server within 48 hours, disabled password-based SSH logins, and implemented a firewall policy update. The corrected system was resubmitted for re-scan, passed successfully, and the compliance record was updated.
This example shows that the pci dss asv list is not just a registry-it's a functional component of a larger compliance system. Without access to an approved vendor, the retailer would have failed its audit and faced penalties from Visa and Mastercard.
The official pci dss asv list is hosted on the PCI SSC's website at https://www.pcisecuritystandards.org/assessors_and_scanning_vendors/. The list includes vendor names, contact details, geographical coverage, and the specific levels of certification they hold.
Before engaging an ASV, organizations should verify that the vendor is currently listed and has no pending suspension or revocation notice. Some vendors offer additional services, such as remediation consulting or integration with SIEM tools, but these are optional. The core requirement remains: the scan must be performed by someone on the official list.
Always confirm that the ASV report includes a unique scan ID, timestamp, and the name of the certified vendor. Reports lacking these details are invalid and will not be accepted by acquirers.
The pci dss asv list ensures consistency, accuracy, and trust in external vulnerability assessments. It is not a suggestion-it is a mandatory requirement for anyone in scope for PCI DSS. Using a non-approved vendor undermines the entire compliance process and exposes the organization to significant risk.