Get Started with Tenable PCI ASV Scanning

To prepare for a Tenable PCI ASV review:

  1. Work with your organization to determine what assets in your cardholder data environment (CDE) are in scope for Tenable PCI ASV scanning and review.

  2. Create a Tenable PCI ASV Scan:

    • (Required) A Tenable PCI ASV scan with the PCI Quarterly External Scan template.

    • (Optional, if web apps are present) A Tenable Web App Scanning using the PCI template. This scan should be run on payment pages, web application pages, or any pages that can be seen as entry into the CDE or that may contain Card Holder Data (CHD).
    Important: By default, PCI scan data is excluded from dashboards, reports, and workbenches. To view this data, when creating a Tenable PCI ASV scan, you must set the Scan Results setting to Show in the workbenches, dashboards, and reports.

    Note: Because Tenable PCI ASV scans using the PCI Quarterly External Scan and PCI template have their own set of rules, any recast rules do not apply to the scan results.

    Note: PCI DSS requires organizations to complete quarterly internal network scans, so you may also need to create a scan using the PCI Internal Network Scan template. However, you do not need to submit the internal network scan results for ASV review and validation.

  3. Launch a Tenable PCI ASV Scan.

    Note: Since a clean scan substantially increases your chances to pass the ASV certification review, Tenable recommends that you launch the Tenable PCI ASV scan as many times as is needed to get the cleanest scan possible.

  4. Submit a Scan for PCI Validation.

  5. Create an attestation request draft. As you create the draft, you may need to do one or both of the following:

    • If your scan results include assets that are irrelevant to the attestation, mark each irrelevant asset out of scope.

    • If the scan results include any failures, create a dispute for each failure.

      Note: If you leave any failures undisputed when you submit your attestation for review, the ASV reviewer must fail the attestation.

  6. After you have addressed all the failures, submit the scan attestation for ASV review.