Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
An Approved Scanning Vendor (ASV) is a company approved by the PCI Security Standards Council (PCI SSC) to perform external vulnerability scans for applicable PCI DSS requirements. Its approval applies to the company’s scanning service and tools—not to a merchant’s PCI DSS compliance or overall security.
What an Approved Scanning Vendor does
PCI SSC describes an ASV as a company approved to conduct external vulnerability scanning services. Its scan solution looks for and reports vulnerabilities in internet-facing systems within the agreed scope. The applicable PCI DSS requirement and the organization’s validation path determine whether an ASV scan is required and which systems are in scope.
ASV approval is a qualification of the provider and its scan solution. A vulnerability-scanning product or subscription does not, on its own, make its provider an ASV. PCI SSC’s glossary gives the short definition; its ASV program listing describes the approved-provider program.
ASV, QSA, and scanner are different roles
- ASV: conducts external vulnerability scans under the applicable PCI DSS scanning requirements.
- Qualified Security Assessor (QSA): is a qualified organization that performs PCI DSS assessments.
- Scanner: is a tool or product. Using one does not establish that its provider is a PCI SSC-approved ASV.
PCI SSC’s PCI DSS information and FAQ 1598 distinguish these roles. An ASV scan is not a substitute for a QSA assessment where one is required, or for other PCI DSS validation work.
#1 Best Overall
- Large format scanner - Helps improve access to and management of all your large files
- Has a color depth of 32-bit
What ASV approval involves
PCI SSC’s qualification process assesses the vendor’s scan solution. Candidates apply through the PCI SSC Portal, provide company documentation and a signed test agreement, and complete a remote test against PCI SSC infrastructure designed to simulate a customer network. The test evaluates scan administration, scan performance, and reporting; it includes scoping conversations, scanning a test perimeter, and preparing executive and detailed reports. Successful companies are added to the ASV list and are subject to annual reapproval. See PCI SSC’s Become an ASV page for current application instructions and program documents.
A PCI SSC interview published in 2020 also described employee training and annual requalification requirements. Because those details are dated, organizations applying should rely on current program documents rather than assume that the 2020 account remains unchanged.
Rank #2
Does an ASV scan make a business PCI DSS compliant?
No. PCI SSC’s FAQ 1234, dated June 2025, says the scan report details scan findings; it does not show that other PCI DSS requirements have been reviewed or are in place. A passing scan may provide evidence for the applicable external-scan requirement, but it is only one part of the entity’s validation obligations.
The FAQ identifies quarterly external vulnerability scans by a PCI SSC ASV under PCI DSS Requirement 11.3.2.1. It also says the official report templates in the ASV Program Guide are required; supplemental vendor documents do not replace those forms. Acquirers or payment brands may request reports or additional information, so confirm reporting expectations with the organization that accepts your compliance validation.
Rank #3
- Standalone network scanner with scanning speeds of 25 ppm/50 ipm (A4 portrait, 200/300 dpi), ADF capacity of 50 sheets
- PC-less scanning with large touch screen and on-screen keyboard
- Supports scanning from thin paper to thick paper, and plastic cards
- Security measures include Login Authentication with custom job menus, Encryption, Data Transmission Security, and more
- USB port to connect devices like a mouse or contactless IC card reader
Who needs a scan, and what is in scope?
Applicability depends on the current PCI DSS materials and the entity’s validation path; do not assume every merchant has identical scan obligations or scope. For a specific example, PCI SSC’s July 2024 resource guide for SAQ A merchants says the ASV scan applies to the e-commerce merchant system that hosts a webpage redirecting payment transactions to a PCI DSS-compliant third-party service provider, or hosts that provider’s embedded payment page or form. In that SAQ A context, the guide describes evidence of passing ASV scans at least once every three months. This example should not be generalized to other merchant types or validation paths.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to find and assess an ASV
- Check the PCI SSC listing. Find providers through the PCI SSC program listings and verify the company’s current status. PCI SSC notes that the listing is frequently updated and may not always be current.
- Confirm scope before choosing a service. Work out which internet-facing systems and external addresses are in scope with the organization responsible for accepting your compliance validation. Ask whether the ASV’s approved scan solution covers them.
- Ask how reports and retesting are handled. Confirm that the provider supplies the official PCI SSC report templates and can help clarify scope, explain findings, and coordinate retesting as needed.
- Perform ordinary vendor due diligence. PCI SSC approval indicates that a vendor met the Council’s requirements to perform PCI data security scanning; it is not an endorsement of the vendor’s business processes or practices. Apply your normal due diligence and compare service terms and support.
For context on the program, PCI SSC’s 2020 article What to Know About the Approved Scanning Vendor Program quotes Gill Woodcock, PCI SSC’s VP Global Head of Programs, describing an ASV as a company approved to scan internet-facing environments of merchants and others.
Quick Recap
Best Value
- FAST BUSINESS PRINTING AND COPYING: The Brother MFC-L5915DW business monochrome laser all-in-one printer delivers high-quality output and print and copy speeds of up to 50ppm(1) to help boost productivity and ensure fast, professional quality documents for busy offices.
- LOW-COST OUTPUT: Help reduce operating costs by using the Brother Genuine TN920UXXL ultra high-yield 18,000-page replacement toner cartridge. Includes a Brother Genuine 3,000-page toner cartridge(2).
- FAST, HIGH-VOLUME SCANNING: The 70-page capacity(3) auto document feeder offers single-pass, two-sided scanning up to 56ipm(4). Features a large document glass for up to legal-sized documents.
- FLEXIBLE CONNECTIVITY OPTIONS: Features built‐in Gigabit Ethernet and dual band wireless networking to seamlessly set up and share on your wired.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
