Run Vulnerability Scan

The PCI DSS External Vulnerability Scan (also called an ASV scan) is the most commonly required compliance scan. You will need to do this scan every 3 months to maintain your compliance.

Our tool helps you schedule and submit your scans.

You need to provide the external (Internet-facing) IP address(es) for the environments where card payments are accepted by your business. This will either be the fully qualified domain name (FQDN) / external IP address(es) of your e-commerce website systems and/or the external IP address(es) of the environments where face-to-face or mail/telephone order payments are processed (such as the external IP address for the location where your payment terminals are used).

To find the IP address of your payment terminal environment, follow the following three steps:

  1. Unplug your payment terminal.

  2. Plug the cable you just unplugged into a computer/laptop.

  3. Go to www.whatismyipaddress.com and the long series of numbers and full stops is your IP address.

Other Technical Requirements

You may need to check the following:

  • If you have active protection systems in place for your IP address(es), you may need to make temporary changes to ensure the Sysnet IP addresses are allowed or whitelisted to allow the ASV scan to be performed unimpeded.

  • If you use load balancers, you must indicate this when scheduling your scans. The ASV will need assurance of a synchronized environment configuration behind any local load balancers and/or will need to accommodate external load balancing to ensure all IP addresses provided are successfully scanned.

Your business activities will not be interrupted by this scan.

Schedule a Scan

To schedule your vulnerability scan, scroll to the Be scan compliant section and click Manage. The Be scan compliant screen displays. From this screen you can schedule a single or group scan, review your scans, manage your domains or upload scan results from a third party.

Before you can schedule a group scan, you need to set up a group via Manage Group Scanning.

To schedule a single scan:

  1. Click Schedule scan.

  2. Enter the domain address or IP address to be scanned by typing the address and clicking Add. Do this for each address that needs to be scanned. You may need to whitelist the list of IP addresses for the scan to run successfully.

  3. Enter the Scan date and Scan time. If you use a dynamic IP address, you must provide the correct address each time you run the scan. In this case, it's best to not schedule your scan in advance.

  4. If your in-scope PCI infrastructure includes a load balancer, select Yes. You then need to indicate if the system configuration is synchronised. Select Yes or No.

  5. Check I confirm that our domain and IP addresses will grant access to the IP address(es) stated above.

  6. Click Schedule Scan.

To add a group:

  1. Click Schedule scan and then select Manage Group Scanning.

  2. Click Add a group. The Add a group pop-up displays.

  3. Enter the Group name.

  4. Select the Group type. Choose between Static IP addresses/domains only or Dynamic IP addresses only.

  5. Click Submit.

    Once created, you can then edit or schedule the group via the Action menu but before you schedule a group scan, you need to enter the IP addresses into the group.

  6. Locate the group in the list and from the Action menu, select Edit Group. Then click Add New Item. The Add New Item pop-up displays.

  7. Enter the Domain/IP Address. Your MID displays automatically.

  8. Enter a Description.

  9. Click Submit. Once all of your IP addresses are added, you can click Schedule to schedule the scan.

To schedule an existing group scan:

  1. Click Schedule scan and then select Manage Group Scanning.

  2. Enter the Group name you want to scan and click Submit.

  3. Return to Schedule Single Scan and select Schedule group scan.

  4. Enter the Scan date and Scan time.

  5. If your in-scope PCI infrastructure includes a load balancer, select Yes. You then need to indicate if the system configuration is synchronized. Select Yes or No.

  6. Check I confirm that our domain and IP addresses will grant access to the IP address(es) stated above.

  7. Click Schedule Scan.

Once your scans are complete, you can select Review your scans to review the results.