How often should internal and external vulnerability scans be performed, and when else?

How often should internal and external vulnerability scans be performed, and when else?

• A. At least quarterly and after significant changes in the network.
• B. Annually.
• C. Monthly for internal scans only.
• D. Only after a breach.

Answer: (A)

Regular vulnerability scanning cadence and change-triggered scans. PCI DSS requires that both internal and external vulnerability scans be performed at least quarterly, with additional scans after significant changes to the network or system components. This ensures ongoing visibility into vulnerabilities and catches new weaknesses introduced by changes, rather than waiting for the next scheduled scan. Annual scans or waiting only after a breach don’t meet the required proactive cadence, and monthly internal scans, while more frequent, aren’t the stated minimum.

Regular vulnerability scanning cadence and change-triggered scans. PCI DSS requires that both internal and external vulnerability scans be performed at least quarterly, with additional scans after significant changes to the network or system components. This ensures ongoing visibility into vulnerabilities and catches new weaknesses introduced by changes, rather than waiting for the next scheduled scan. Annual scans or waiting only after a breach don’t meet the required proactive cadence, and monthly internal scans, while more frequent, aren’t the stated minimum.