ASV scans
Quarterly ASV scans. Scheduled, followed up, filed.
If your agency takes payments through its website, your SAQ requires an external vulnerability scan by an Approved Scanning Vendor at least once every three months. We run the scans, help you resolve what they find and keep every passing report with your PCI DSS file.
In short
An ASV scan is an external vulnerability scan of the internet-facing systems in scope for PCI DSS, performed by an Approved Scanning Vendor listed by the PCI Security Standards Council. PCI DSS requirement 11.3.2 asks for one at least once every three months, and after any significant change, with a passing result. For travel agencies it usually applies to SAQ A when the website redirects to or embeds the payment page, and to SAQ A-EP.
Who needs them
Do you need ASV scans?
You need them if
- Your website redirects customers to the payment provider's page, or embeds it (SAQ A).
- Your website builds the payment form itself (SAQ A-EP).
- Your agency stores or processes card data on its own systems (SAQ D).
You usually do not if
- You only send payment links generated by your provider, and your website takes no payments.
- You key card details into a provider's virtual terminal and store nothing (SAQ C-VT).
How it works
Four steps, every quarter.
- 01
Scope
We confirm with you which domains and IP addresses are in scope.
- 02
Scan
The Approved Scanning Vendor scans them from the internet, without touching your internal network.
- 03
Fix
If a scan fails, we explain each finding in plain language and rescan once it is fixed.
- 04
File
Each passing report is kept with your SAQ and attestation, ready whenever IATA or your acquirer asks for it.
Common questions
How often are ASV scans required?
At least once every three months, and after any significant change to the systems in scope, such as a new website or a new hosting provider.
What does a passing scan mean?
The scan found no vulnerabilities that the PCI SSC's ASV Program Guide classes as failing. A failing scan is not a sanction: you fix the findings and scan again.
Will the scan affect our website?
ASV scans are external and designed not to disrupt the systems they test. They look only at what is reachable from the internet.
We already use an ASV. Can you still prepare our SAQ?
Yes. Send us its latest passing reports and we include them in your PCI DSS file.
Final call
Ready for departure?
First time or renewal, your PCI DSS prepared by specialists in travel agency compliance.
