Who ultimately decides the scope for the ASV scan?

Who ultimately decides the scope for the ASV scan?

• A. The merchant
• B. The ASV
• C. The PCI auditor
• D. The software vendor

Answer: (A)

The merchant. In PCI DSS, the merchant owns the responsibility for defining what parts of their environment are in scope for compliance, including all systems that store, process, or transmit cardholder data and any systems that could impact the security of that environment. The ASV’s role is to perform the external vulnerability scan on the defined scope and report results; they do not decide what is in scope. The PCI auditor (QSA) verifies that the scope and the scanning are appropriate for compliance, and the software vendor does not determine scope.

The merchant. In PCI DSS, the merchant owns the responsibility for defining what parts of their environment are in scope for compliance, including all systems that store, process, or transmit cardholder data and any systems that could impact the security of that environment. The ASV’s role is to perform the external vulnerability scan on the defined scope and report results; they do not decide what is in scope. The PCI auditor (QSA) verifies that the scope and the scanning are appropriate for compliance, and the software vendor does not determine scope.