What are the PCI DSS v4.0 SAQ A ASV Scan Requirements?

These days, to survive amidst the fierce competition of online commerce, merchants must prove they can safeguard sensitive cardholder data, and that means attaining and maintaining PCI compliance. And while the Self-Assessment Questionnaire (SAQ) A is often considered one of the more appealing routes to achieving that compliance, PCI DSS v4.0 has added new requirements to the SAQ A regarding Approved Scanning Vendor (ASV) scans.

To be clear, there are several methods for verifying your compliance under PCI DSS—the SAQ A is just one. But as experienced PCI QSAs who have spent a lot of time analyzing and disseminating the latest version of the standard, we feel it’s important to point out what’s changed for those who have previously completed this specific SAQ or are considering it for their initial compliance.

In this article, we will overview the PCI SAQ A and its new requirements regarding ASVs so that you’re not surprised by the updates when you begin to fill out your SAQ A.

What is the PCI DSS SAQ A?

First, let’s back up for a moment to paint a complete picture—all companies that store, process, transmit, or affect the security of credit card data are required to demonstrate PCI compliance. When doing so, companies should contact the acquiring bank to confirm if there is an option to complete an assessment questionnaire referred to as the "PCI DSS Self-Assessment Questionnaire."

There are several kinds of SAQs, and what kind of SAQ you opt for depends on the type of payment channel you—as an online merchant—employ. In our experience, most online merchants are often torn between the SAQ A-EP and the SAQ A.

Of those two, if you’re a merchant who has an e-commerce implementation for taking payments and account data functions are outsourced to PCI-validated third parties, SAQ A can be the simplest validation mechanism—that’s largely been due to the minimal number of requirements (up to 29) you have to meet.

ASV Scans and Your PCI DSS v4.0 SAQ A

Those SAQ A requirements previously did not include ASV scans, but as we said, PCI DSS v4.0 introduced some huge new complexities for this questionnaire. Now, SAQ A companies must have external vulnerability scanning performed by a PCI Council-approved third-party scanning vendor—otherwise known as ASV scans.

Per PCI DSS v4.0 Requirement 11.3.2, you must scan using an ASV every 90 days (at least) to ensure that you, as the online merchant, examine and remedy any vulnerabilities on your e-commerce website.

ASV Scanning can no longer be avoided for the SAQ A, even if you use a redirect or an iFrame. In PCI DSS v4.0, you’ll still need to have ASV scanning performed on your systems hosting the payment page and your website.

Why, you may be wondering—as an SAQ A eligible merchant, you don’t directly store or process card data, so why do your pages need to be scanned? The answer is increasing online or card-not-present fraud.

Bad actors always look for unpatched and vulnerable servers to exploit, and the servers hosting your webpage could have vulnerabilities that allow those cyber criminals to inject malicious code into legitimate payment pages. Malicious actors could also potentially replace the redirect and iFrame with their own checkout pages, leading to customers sending transactions to criminals instead of your intended third-party source.

Given all these sophisticated attacks, a lack of external ASV scanning jeopardizes the security of your webpages and negatively affects the security of your redirect and iFrame solution. But as they are now required for your PCI DSS SAQ A compliance, you’ll be able to better protect your customers.

Recommended Best Practices for PCI DSS ASV Scans

Because these new requirements in PCI DSS v4.0 represent an enormous shift for SAQ A merchants who may not have any prior experience with ASV scans, here are some best practices merchants may want to consider when satisfying the new standard’s mandates:

• When performing scoping exercises prior to an audit, don't narrowly target just the payment page—thoroughly define your scan scope to include all in-scope systems.
  • You can find guidance from the PCI council here on how to define the scope of your ASV scanning (ASV Program Guide v4.0 r2, page 15).
• For integrated payment forms, whitelist the iFrame source, as that’ll reduce the attack surface by allowing content from trusted sources.
• Monitor and validate your payment service provider’s compliance with PCI. This assures compliance within your validation assessment and confirms that responsibilities are clearly defined regarding the protection of payment information—if they’re not compliant, this will likely jeopardize your own compliance.
• Closely monitor ASV scan results and quickly remediate any critical or high findings—vulnerabilities like these are considered exploits and should never linger.
• Ensure that ASV scans are conducted by an approved PCI SSC ASV, as these ASVs have to undergo specific training of requirements and scanning procedures to ensure that the scans they conduct for their customers meet the rigor and report quality set by the PCI SSC.
  • Remember to obtain an “Attestation of Scan Compliance” for each ASV scan completed as a part of the final scan results.
• Document your scanning procedures and whitelisting controls for integrated payments so that you have clear guidelines on how to conduct scans and maintain compliance.
• Schedule ASV scans every 30 days instead of every 90 days to detect any new issues and significant changes arising between quarterly scans so that you identify and address vulnerabilities promptly.
• Verify the security of any payment page redirects and iFrames through code reviews and testing so that you confirm the security of all endpoints handling sensitive card data.
• Stay up-to-date on PCI DSS changes and leverage all the tools available to reduce your risk exposure and help protect your business from being the next major security breach headline.

Moving Forward with PCI DSS v4.0

As the most recent surge in sophisticated data breaches and malicious cyber-attacks continues, a layered security approach and vigilance in compliance will be key to keeping customer data safe. In recognition of this, PCI DSS v4.0 now requires organizations pursuing SAQ A validation to perform quarterly ASV scans to help secure critical customer data.

Performance of ASV scans will be a crucial validation step that’ll also ensure you actively detect and remedy security vulnerabilities before they’re used by hackers. That being said, ASV scans do require diligent planning and execution, but by following best practices, merchants going through an SAQ A can both meet compliance needs and provide customers with the highest level of payment security.

To learn more about the changes in PCI DSS v4.0, check out our extensive library of detailed content that breaks down different new facets of this important payment card standard and will help you simplify your compliance adjustments.