How often are ASV scans performed?

NORBr runs external vulnerability scans every week. Qualys, an Approved Scanning Vendor, certifies the results in line with PCI DSS: quarterly at most, usually monthly.

What an ASV scan is

PCI DSS requires external vulnerability scans of the systems exposed to the internet, performed or certified by an Approved Scanning Vendor. The scan looks for known vulnerabilities and misconfigurations on the external perimeter, and a passing result is part of the evidence a service provider presents.

Weekly scanning, regular certification

Scanning weekly goes beyond the quarterly minimum. Issues surface quickly and are handled before the next certified scan, rather than accumulating between certification dates. Certification then confirms the perimeter meets the standard.

Where to find the reports

Every certified report is published in the Trust Center as soon as it is issued. The executive summary is available in the portal, and the technical report is available on request.

Why it matters for operators

Your merchants, partners and auditors may ask how the infrastructure behind your platform is monitored. ASV reports are part of the answer, alongside the PCI DSS Attestation of Compliance. Having them current and in one place lets your security team respond quickly, and lets your own assessor review them directly when you give them access.