It is compulsory to submit scan report results according to each payment brand's compliance reporting requirements.

It is compulsory to submit scan report results according to each payment brand's compliance reporting requirements.

• A. SOMETIMES
• B. CANNOT BE DETERMINED
• C. TRUE
• D. FALSE

Answer: (C)

Submitting scan results to meet payment brand reporting requirements is mandatory because external vulnerability scans are part of PCI DSS validation. The standard requires quarterly scans by an Approved Scanning Vendor and, crucially, that the results are shared with the entities responsible for validating compliance—typically the acquiring bank or the payment brands—in the format and within the timelines each brand specifies. This process lets brands verify that vulnerabilities are being identified and remediated on an ongoing basis. Not submitting according to brand requirements can jeopardize PCI compliance and expose you to penalties, so the statement is true.

Submitting scan results to meet payment brand reporting requirements is mandatory because external vulnerability scans are part of PCI DSS validation. The standard requires quarterly scans by an Approved Scanning Vendor and, crucially, that the results are shared with the entities responsible for validating compliance—typically the acquiring bank or the payment brands—in the format and within the timelines each brand specifies. This process lets brands verify that vulnerabilities are being identified and remediated on an ongoing basis. Not submitting according to brand requirements can jeopardize PCI compliance and expose you to penalties, so the statement is true.