c11.1 Internal and external vulnerability scans
Run internal and external vulnerability scans regularly and after significant changes, addressing findings by risk ranking. External ASV scans must be performed quarterly.
Requirement 11
Test Security of Systems and Networks Regularly
PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.
11.3 External and internal vulnerabilities are regularly identified, prioritized, and addressed
- 11.3.1 Internal vulnerability scans performed and resolved Covered
- 11.3.1.1 Non-high/critical vulnerabilities managed per risk Your responsibility
- 11.3.1.2 Internal scans via authenticated scanning Covered
- 11.3.1.3 Internal scans after significant changes Covered
- 11.3.2 External vulnerability scans performed quarterly by ASV Covered
- 11.3.2.1 External scans after significant changes Covered
How to implement on AWS
Cover continuous internal scanning with Amazon Inspector. For quarterly external scanning, engage an Approved Scanning Vendor (ASV). Rescan after significant changes. Track remediation until a passing result is achieved. Consolidate in Security Hub.
Practical implementation
How this control is implemented in each reference architecture:
Cover internal scanning continuously with Inspector and satisfy the quarterly external scan with an Approved Scanning Vendor (ASV).
- Use Amazon Inspector for continuous internal vulnerability scanning of EC2/ECR/Lambda, addressing high/critical findings by risk ranking.Account-wide detection
Amazon Inspector - Engage a PCI SSC Approved Scanning Vendor (ASV) for the quarterly external scans of your internet-facing endpoints.
- Rescan after significant changes and track remediation until a passing result; consolidate in Security Hub.Account-wide detection
Security Hub
How to validate: Internal scans occur at least quarterly with high/critical findings resolved, and passing ASV reports exist for each quarter from a PCI SSC ASV.
Avoid: Treating Inspector as the ASV scan. The external quarterly scan must come from an approved vendor; Inspector covers the internal side.
Run internal scanning org-wide and coordinate the quarterly ASV external scans for every internet-facing CDE endpoint.
- Enable Inspector org-wide (delegated admin) so all CDE accounts are scanned internally with findings consolidated centrally.Security tooling account → PCI OU Amazon Inspector
AWS Organizations Security Hub - Coordinate quarterly ASV external scans for each internet-facing CDE endpoint across accounts.
- Track rescans-after-change and remediation to passing centrally.Security tooling account Security Hub
How to validate: Org-wide Inspector coverage is complete, and every internet-facing CDE endpoint has passing quarterly ASV reports.
Avoid: Scanning only one account's endpoints. Each internet-facing CDE endpoint needs its own quarterly ASV coverage.
PCI validation
Testing procedures
- Examine internal scan reports from the last 12 months to verify scans occurred at least every 3 months and that all high-risk and critical vulnerabilities were resolved (11.3.1.a, 11.3.1.b).
- Examine ASV scan reports to verify external scans occurred at least every 3 months, met the ASV passing criteria, and were completed by a PCI SSC ASV (11.3.2.a, 11.3.2.b, 11.3.2.c).
Evidence in AWS
- Amazon Inspector internal scan reports with remediation evidence.
- Passing quarterly ASV reports (external vendor).
- Record of rescans after significant changes.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 11.3 — The security posture of all system components is verified periodically using automated tools designed to detect vulnerabilities, and detected vulnerabilities are addressed based on risk.
AWS services
Amazon Inspector AWS Security Hub Learning resources
References
- PCI DSS v4.0.1 Requirement 11.3