PCI ASV Program Guide Part One

PCI ASV Program Guide Part One
Participating Payment Brands

PCI Standards Compliance

 Requirements, mandates, or dates for PCI DSS compliance

 Fines or penalties for non-compliance

PCI SSC

ASV Program

 ASV Program Guide and ASV Qualification Requirements

 Training for ASV Companies and ASV Employees

 Evaluation of ASV Company and ASV Employee qualifications

 List of Approved Scanning Vendors

 Quality assurance program for ASVs

ASVs

Responsibilities

 Performing external vulnerability scans

 Maintaining security and integrity of systems and tools

 Scanning all IP address ranges, domains, components, etc.

 Consulting with the scan customer to determine scope

 Providing determination and documentation of scan compliance

 Submitting ASV Scan Report and Attestation of Scan Compliance

 Retaining scan reports and related work papers

 Providing means for disputing findings

 Maintaining internal quality assurance process

ASV Validation Labs

Responsibilities