Skip to main content

💼 11.3.1 Internal vulnerability scans are performed.

Description​

As follows:

  • At least once every three months.
  • High-risk and critical vulnerabilities (per the entity's vulnerability risk rankings defined at Requirement 6.3.1) are resolved.
  • Rescans are performed that confirm all high-risk and critical vulnerabilities (as noted above) have been resolved.
  • Scan tool is kept up to date with latest vulnerability information.
  • Scans are performed by qualified personnel and organizational independence of the tester exists.

Similar​

  • Sections
    • /frameworks/pci-dss-v3.2.1/11/02/01
    • /frameworks/pci-dss-v4.0.1/11/03/01

Similar Sections (Take Policies From)​

SectionSub SectionsInternal RulesPoliciesFlags
💼 PCI DSS v3.2.1 → 💼 11.2.1 Perform quarterly internal vulnerability scans. Address vulnerabilities and perform rescans to verify all “high risk” vulnerabilities are resolved in accordance with the entity's vulnerability ranking.
💼 PCI DSS v4.0.1 → 💼 11.3.1 Internal vulnerability scans are performed.3

Similar Sections (Give Policies To)​

SectionSub SectionsInternal RulesPoliciesFlags
💼 PCI DSS v3.2.1 → 💼 11.2.1 Perform quarterly internal vulnerability scans. Address vulnerabilities and perform rescans to verify all “high risk” vulnerabilities are resolved in accordance with the entity's vulnerability ranking.
💼 PCI DSS v4.0.1 → 💼 11.3.1 Internal vulnerability scans are performed.3

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 11.3.1.1 All other applicable vulnerabilities (those not ranked as high-risk or critical) are managed.
💼 11.3.1.2 Internal vulnerability scans are performed via authenticated scanning.
💼 11.3.1.3 Internal vulnerability scans are performed after any significant change.