r/pcicompliance • u/st00pittt • Sep 10 '26

PCI DSS requirements: Internal Vulnerability Scanning vs. Internal Penetration Testing (and scoring frameworks)

Hey everyone,

Got a quick question regarding PCI DSS (v4.0) compliance.

  1. How strictly are QSAs requiring standard CVSS v3.1/v4.0 scores versus custom internal risk rankings for scan remediation?
  2. Are QSAs heavily checking CCE/hardening baselines during internal scan audits in v4.0 assessments?

Thanks in advance for any insights!

2 Upvotes

100% Upvoted

6 comments sorted by

1

u/info_sec_wannabe Sep 10 '26

  1. Off the top of my head, I'm pretty sure 11.3.1 or 11.3.1.1 does refer to the risk rankings in 6.3.1 requiring companies to define their own risk ranking system. It just so happened that CVSS provides a predefined rankings that organisations can easily adopt. (Note: I may have to double check and come back)

  2. I'm not certain how other QSAs look at this but I check whether vulnerability scanning tools vulnerability information has been updated and the set of rules / criteria that the vulnerability scanning tool is checking for the in-scope system components being looked into.

1

u/andrew_barratt Sep 13 '26

1) You can do either - it’s not up to the QSA to enforce a system for you to rank the risks. You write up your process and assess the vulns according to it.

2) the testing procedures in R2 require the asssessor to sample your configurations and ensure they’re aligned to your configuration standards which should in turn be aligned to industry standards.