Internal scans (11.3.1) can be run by qualified staff who are reasonably independent of what they scan, or by a specialist firm, with no QSA or ASV needed. External scans (11.3.2) must be run by a PCI SSC Approved Scanning Vendor. Both happen at least every three months and after significant change. This is not legal advice.
Internal scans, 11.3.1
The SAQ D text requires scans at least once every three months, resolution of high-risk and critical vulnerabilities as ranked under 6.3.1, rescans confirming those are resolved, a scan tool kept up to date, and qualified personnel with organizational independence. The note gives an example: a network administrator should not scan the network they run.
11.3.1.1 adds that other vulnerabilities are handled based on your targeted risk analysis (12.3.1), with rescans as needed.
External scans, 11.3.2
External scans must be run by an ASV, vulnerabilities are resolved, and the ASV Program Guide requirements for a passing scan are met, with rescans as needed. For a first assessment, the note says four passing scans in 12 months are not required if the assessor verifies the latest scan passed, you have a documented quarterly policy, and findings were corrected as shown by rescans. In later years, passing scans every three months must have occurred.
PCI SSC describes an ASV as an organization whose scan solution the Council has tested and approved, with annual re-approval. The listing does not constitute an endorsement.
After a significant change, 11.3.2.1 asks for an external scan with vulnerabilities scored 4.0 or higher by CVSS resolved.
Side by side
| Internal | External | |
|---|---|---|
| Requirement | 11.3.1 | 11.3.2 |
| Frequency | Every three months | Every three months |
| Performed by | Qualified, independent staff or a firm | ASV |
| Rescan | Yes, to confirm high-risk and critical fixes | Yes, until a passing scan |
| Also after significant change | Check 11.3.1.3 | 11.3.2.1 |
Practical steps
- Put both scan windows on the calendar with owners.
- Agree the ranking from 6.3.1 before the first scan.
- Share target details with the ASV early, since the text says load balancers and providers should be worked out between you.
- Fix, rescan and keep every report.
- Keep reports ready for the SAQ submission.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how findings are tracked to resolution.
Quick check
Can our own security team run the external scan?
No. 11.3.2 specifies an ASV.
Does a clean internal scan satisfy the external one?
No. They are separate requirements with different performers.
On Safeguard: vulnerability findings are tracked in one place with status, which supports the rescan loop for your internal process. It is not an ASV. Try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
