How to Choose an ASV Scanning Provider for Your Business – Picking an ASV scanning provider starts with how well the service fits the way the business runs. The wrong fit leads to missed deadlines and reports that banks send back. The right fit keeps external scans on schedule and makes the results easy to document.
Start with approval, not marketing claims
For scans used to meet PCI DSS Requirement 11.3.2, choose a provider on the official ASV list maintained by the PCI Security Standards Council (PCI SSC). Marketing language is not proof.
Check the Council directory by provider name and confirm the listing is current. Then confirm the exact scan service being sold is the approved scan solution. Approval applies to a specific service, so a provider with approved status can still sell other scan products that don’t count for compliance.
ASV stands for Approved Scanning Vendor. This check ties directly to Requirement 11.3.2, which calls for external scans of internet-facing systems in or connected to the cardholder data environment at least once every three months. A passing scan does not mean the full PCI DSS program is complete. It means one requirement is met for that period.
Get scope right before you sign
Scope mistakes can undermine an otherwise passing scan. Leaving out an in-scope internet-facing IP or domain creates a gap in the evidence submitted to the bank or assessor. Don’t assume the provider will discover every missing asset on its own.
Share a full inventory before you sign. That inventory must list domains and IPs tied to payment functions and support functions. It must also show cloud-hosted assets with clear ownership and contact details. If the business uses both IPv4 and IPv6, both ranges need to be listed clearly so nothing slips through.
Ask how the service covers in-scope web applications exposed to the internet, including login pages and customer portals. Clarify any technical limits and how assets behind hosting services or protective gateways will be scanned.
Network segmentation can shrink this list when it truly isolates cardholder systems from other networks.
When reviewing service information about pci asv certification from providers such as IS Partners, separate vendor approval from your business’s validation responsibilities. Your team still needs to agree on scan scope and act on findings.
Ask how retests and disputes work
A first scan may identify vulnerabilities or findings that need investigation. Choose a provider whose follow-up process is clear before a deadline approaches.
Ask what proof is needed to clear a false positive. A strong process requires evidence such as configuration records or scan output and then documents the decision. It doesn’t clear findings based on a short email alone.
Find out how rescans are scheduled and how fast results come back. There’s often pressure to fix issues and prove the fix before the next due date. A clear turnaround time helps the business plan patch work and avoid a missed period.
Ask how the portal tracks status through the fix cycle. Open items and due dates should appear in one view that managers can check each week, rather than in a pile of PDFs lost in email threads. That view makes it easier to follow up with owners before time runs out. It also gives assessors a clear record without extra back and forth.
Get the number of rescans included in the fee in writing.
Make the report usable for banks and assessors
A passing result must be easy to hand to others. Banks and assessors need a clean report that maps to PCI DSS rather than raw tool output.
Ask for a sample report before you buy. Look for clear pass or fail status for each IP and clear notes on any disputed findings. The report must show scan dates and scan scope so due dates are easy to track. A confusing sample is a warning sign: the final report will likely create the same confusion for a bank and delay sign-off during review.
Confirm the provider will supply an Attestation of Scan Compliance with each passing scan. That document is the formal proof that the scan met ASV rules. Keep it with SAQ records or hand it to the assessor when asked.
Good records also help internal teams. A central place to track open findings and due dates keeps work from slipping between scans. It also helps new staff see what was fixed and what is still open.
Judge support and pricing together
Price alone says little. Two quotes can look alike yet cover very different levels of help. Focus on what the fee includes and how help arrives when time is short.
Ask who answers questions during remediation. There’s a big difference between a ticket queue and access to a person who knows ASV rules. Ask about hours and response times.
Find out what the base fee includes for the year. Some plans have four scans with rescans and attestations. Other plans charge per rescan or per extra IP block. Get the total cost for at least once every three months coverage so there are no surprises.
Support quality shows during the first false positive or failed host. Fast and clear answers save days, while slow or vague replies can push fixes past the due date.
Choose a provider that makes scan scope, remediation, and evidence manageable for your team. Check approval, schedule scans early enough for fixes, and keep reports ready. Those habits support the scanning program without replacing the rest of PCI DSS compliance.