Common use of Vulnerability Scans Clause in Contracts

Vulnerability Scans. A vulnerability scan (“Scan”) is necessary for any merchant with Internet accessible I/P addresses connected to or that could allow access to their cardholder data environment. This includes, but is not limited to internet connected terminals, internet connected registers, and ecommerce environments. Here are the steps to receive your Scan: 1. Once you have completed your SAQ, the system will guide you to schedule a Scan, if applicable. 2. The Scan will identify vulnerabilities or gaps that may allow unauthorized or malicious users to gain access to your network and potentially compromise cardholder data. The Scan does not require you to install any software, and no denial-of-service attacks will be performed. 3. Upon completion of the Scan, you will receive a link to your full compliance report. A network vulnerability review failure means that the Scan discovered areas of severe vulnerability. The report describes the issues found and provides you with recommendations for scan resources to begin fixing the problems. The tool will guide you to remediate the failed Scan and work toward achieving compliance. Once you have addressed the vulnerabilities, simply schedule a follow-up Scan to ensure your remediation of the problem meets the PCI DSS requirements.