## ASV Scanning
PCI Requirement 11.2 requires periodic unauthenticated scanning of a merchants externally-facing in-scope PCI environment to identify vulnerabilities that can potentially be exploited. The PCI-DSS council certifies Approved Scanning Vendors (`ASV`) to provide the ability to scan a merchants external PCI environment and provide an independent review of potential risk. ASV scanning is conducted on a quarterly basis and must demonstrate results that pass a third-party assessment which is completed by the ASV. For GitLab that is Tenable.io.
[PCI ASV Program Guide](https://www.pcisecuritystandards.org/documents/ASV_Program_Guide_v3.0.pdf)
### Vulnerability Reporting
#### Report Submission
Each quarter the merchant must submit to the ASV scan results to validate the external PCI environment is in compliance by the report not containing "High" or "Medium" severity vulnerabilities or any features or configurations that conflict with PCI-DSS. Vulnerability severity levels are based on the National Vulnerability Database (`NVD`) and Common Vulnerability Scoring System (`CVSS`).
Report submissions for ASV attestation will occur on the following dates each year(coinciding with the GitLab fiscal calendar):
* February 1st
* May 1st
* October 1st
* January 1st
{-Please Note-}: First submission will be made by 2020-06-01 to allow for remediation timeframe to be completed.
The four previous passing scans will be submitted to requesting PCI acquirer with the latest PCI SAQ-A in the month of February.
#### Meeting External Scan Compliance
Vulnerability reports must be able to demonstrate compliance on two levels:
* Overall compliance of the merchant's external PCI environment
* No vulnerability with an assigned CVSS score of 4.0 or higher
#### Report Format
The scan report must have the following three sections:
1. Attestation of Scan Compliance
* This is the overall summary that shows whether the scan customer’s infrastructure met the scan requirements and received a passing scan.
2. ASV Scan Report Summary
* This section of the scan report lists vulnerabilities by component (IP address, hosts/virtual hosts, domains, FQDN, etc.) and shows whether each component scanned received a passing score and met the scan requirement.
3. ASV Scan Vulnerability Details
* This section of the scan report is the overall listing of vulnerabilities that shows compliance status (pass/fail) and details for *all* vulnerabilities detected during the scan.
#### Scan Results
A completed scan has one of four results:
1. A passing scan 👍`This is the only result that will be accepted to comply with quarterly external ASV requirement`
2. A failing scan for which the scan customer disputes the results ⚠️
3. A failing scan that the scan customer does not dispute 👎
4. A failing scan due to scan interference ❓
#### False Positives
The scan customer may dispute the findings in the ASV scan report including, but not limited to:
* Vulnerabilities that are incorrectly reported (false positives)
* Vulnerabilities that have a disputed CVSS Base score
* Vulnerabilities for which a compensating control is in place
* Exceptions in the scan report
* Conclusions of the scan report
* List of components designated by scan customer as segmented from the CDE
* Inconclusive ASV scans or ASV scans that cannot be completed due to scan interference
A dispute must be submitted in writing and can include screen captures, configuration files, system versions, file versions, list of installed patches, etc.
#### Compensating Controls
Another method of results dispute is demonstrating the use and implementation of compensating controls of identified scan results by the ASV.
#### ASV Scanning Workflow Diagram
```mermaid
graph TD
A(Determine Scan Scope) --> B[Provide list of identified