Guide
ASV scan vs penetration test: two different PCI duties
The ASV scan vs penetration test question comes up in almost every PCI program. They are separate requirements with different providers, schedules and reports, so one never stands in for the other.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
ASV scan vs penetration test in one table
Both sit under requirement 11. However, they answer different questions and produce different documents.
| ASV scan | Penetration test | |
|---|---|---|
| Who performs it | An Approved Scanning Vendor | A qualified internal or external tester |
| How often | Quarterly, and after significant changes | At least annually, and after significant changes |
| Scope | Internet-facing systems in scope | The cardholder data environment and its boundary |
| Method | Automated external scan | Manual-led testing under a written scope |
| Output | Scan report with pass or fail | Test report with findings and a retest |
What each one proves
A passing scan shows no known high-risk issues were found on external systems that quarter. Meanwhile, a penetration test shows how a skilled tester fared against your environment under a written scope.
So the scan is a frequent health check, and the test is a deeper annual review. Because the questions differ, the QSA looks for both.
ASV scan vs penetration test: schedule check
Tick what your calendar already holds.
Your result appears here as you tick, so you can see what is still open.
ASV scan vs penetration test scheduling
Plan four passing scans a year, spread across the quarters. Then book the annual test early, so the retest fits before your assessment.
Also schedule both after significant changes. For example, a new payment flow or a hosting move.
Segmentation testing is separate again
If you use segmentation to reduce scope, it needs its own testing. Merchants test it at least every 12 months, and service providers every six months.
So a complete schedule has three lines: scans, the annual test and segmentation checks.
Which providers you need
The scan must come from a company on the official list. The test can come from a qualified internal team or an independent firm, as long as it is organizationally independent.
In addition, keep each provider's reports in one folder per year. Then the QSA finds them quickly.
Where Ashcroft helps
We build the schedule, brief providers and organize the evidence. Our gap analysis fee runs $8,000 to $40,000. We are not a QSA and we do not run ASV scans. Approved vendors appear on the official Approved Scanning Vendor list.
ASV scan vs penetration test questions
Does a passing ASV scan vs penetration test mean we can skip one?
No. Both are separate requirements, so you need both.
Can the same company do the ASV scan vs penetration test work?
It can, if it is an approved scanning vendor and qualified to test.
Which costs more, ASV scan vs penetration test?
Usually the test, because it is manual-led work under a written scope.
Do SAQ merchants need both?
It depends on the SAQ type. Check the questionnaire that applies to you.
Related guides
Plan the ASV scan vs penetration test calendar
Tell us your payment channels and current providers. We reply with a written estimate, usually inside one business day.
Get my written estimate