This article applies to:
- External Vulnerability Scanning – Scan Target Attestation
Purpose:
- This process is designed to ensure security and compliance by providing a clear way to review and confirm your scanning environment and setup.
Information:
Effective February 1, 2019, passing PCI External Vulnerability Scan results will not apply to the account status unless there is an active attestation on record. Scan target(s) – IP Addresses and/or website URLs – will require verification at least once every 90 days, or any time changes are made to your current scan target(s).
An attestation expiration and acknowledgment link will be found under the "PCI Network Vulnerability Scan" space on your PCI Manager dashboard. This offers quick access to renew your attestation from the Home page, if there have been no changes to the current scan setup.
You will also be prompted to confirm your current scan target(s) any time changes are made to the current scan setup, which will automatically reset the 90-day attestation window.
What this means for me:
Will my PCI Account Status be affected?
Yes. As of February 1, 2019, if your credit card environment requires External Vulnerability Scanning as part of PCI Compliance, the outcome of your scans will not count towards compliance without confirmation of the scan target(s). Once they’ve been confirmed using the "Acknowledge my scan setup" link, your account status will update to reflect any current, passing scans.
Will scans continue to run if I haven't attested to the target(s)?
Yes. Your current scan schedule will not be affected by this requirement. The results of any passing scans will not, however, be applied to the account’s status until the scan target(s) have been verified. If this happens, simply log into your account, confirm the scan target(s), and the results of any current, passing scans will be automatically applied towards the account status.
Will I still be able to see the scan results even if I forgot to attest to my scan target(s) on time?
Yes. You will still have access to the scan report online and by downloading a PDF copy, including remediation information for current vulnerabilities.
PDF reports of your scans will reflect the attestation status at the time the report is generated.
- Reports on unconfirmed target(s) will include the following statement:
- PDF reports of scans run on verified target(s) will include the following statement:
Will I be assessed non-compliance fees/penalties if I haven't attested yet?
Most likely. Your account status will certainly be affected if you haven’t yet attested to the scan target(s) prior to February 1, 2019. PCI DSS requirements, however, are typically enforced by different groups, depending on your card processing environment. If you would like to confirm any potential penalties for lack of PCI Compliance you are highly encouraged to contact your merchant bank, or other group requiring you to demonstrate compliance. Trustwave does not enforce PCI Compliance.
Video Resources: