Global · PCI DSS · ASV · QSA · Requirement 11

PCI ASV scans and QSA assessments, run end to end by Sumrite.

PCI DSS needs quarterly external scans by an Approved Scanning Vendor and, for many organisations, an assessment by a Qualified Security Assessor. Sumrite runs the penetration and segmentation testing, and the ASV scans and QSA work come through PCI SSC listed partners.

Get a quoteAll accredited testing
ASV and QSA partnersListed by the PCI Security Standards Council.
Requirement 11 coveredPentest (11.4), segmentation (11.4.5) and ASV scans (11.3.2).
One teamScoping, fixes and rescans coordinated by Sumrite.

The PCI Security Standards Council lists Approved Scanning Vendors (ASVs), who run the quarterly external vulnerability scans PCI DSS requires under Requirement 11.3.2, and Qualified Security Assessors (QSAs), who assess compliance and issue Reports on Compliance. Sumrite runs the penetration and segmentation testing under Requirement 11.4 and coordinates the ASV scans and QSA assessment through its PCI SSC listed partners.

Who needs it

WhoWhen it applies
MerchantsQuarterly ASV scans and, at higher levels, a QSA Report on Compliance
Service providersQSA assessment, ASV scans and six-monthly segmentation tests
Payment and fintech start-upsGetting to a first passing ASV scan and a clean penetration test
Acquirers’ requestsEvidence your acquiring bank asks for at renewal

How Sumrite delivers it

Sumrite runs the engagement end to end: scoping, expert-led testing, remediation support and the retest. Where the scheme requires a specific accredited, empanelled, licensed or registered firm, the formal report or attestation is issued through a Sumrite partner firm that holds it, so you deal with one team throughout.

  1. Confirm your level. Merchant or service provider level, SAQ or ROC, and what your acquirer expects.
  2. Penetration and segmentation testing. Internal, external and segmentation tests under Requirement 11.4 by Sumrite.
  3. ASV scans and rescans. Run by the listed ASV partner until a passing scan is achieved.
  4. QSA assessment. Where needed, the QSA partner assesses and issues the Report on Compliance.
FrameworkPCI DSS complianceRequirement by requirement, with the testing evidence.GuidePCI DSS penetration and segmentation testingRequirement 11.4 explained.ServiceNetwork VAPTInternal, external and segmentation testing.
IndiaCERT-In empanelled auditGovernment systems and websites, SEBI regulated entities, tenders that name CERT-InGlobalCREST accredited testingBanks, regulators, enterprise buyers and tenders that ask for CRESTSaudi ArabiaNCA licensed testingGovernment entities, critical national infrastructure and their suppliers

Frequently asked questions

Does a PCI penetration test need a QSA?

No. PCI DSS requires a qualified, organisationally independent tester for 11.4. ASV scans (11.3.2) must be run by a listed ASV, and a Report on Compliance by a QSA.

How often are ASV scans required?

At least once every three months and after significant changes, with a passing result each quarter.

Can Sumrite deliver ASV scans and QSA assessments?

Yes, through PCI SSC listed partners, with Sumrite running the penetration testing and coordinating the whole programme.

Accredited testing

All schemes and regionsCERT-In empanelled audit (India)CREST accredited testing (Global)NCA licensed testing (Saudi Arabia)

Need a test a regulator or buyer will accept?

Send the requirement and the deadline. NDA first, fixed-scope quote, one team end to end.

Get a Quote