Organization should perform quarterly vulnerability scans
High
Cross-cloud
General
manual-pci-vulnerability-scanning
How to fix it
Perform internal vulnerability scans at least quarterly and after significant changes. Perform external scans by an ASV at least quarterly. Rescans must confirm remediation of high-risk vulnerabilities.
How to verify
- Verify quarterly internal scan reports
- Verify quarterly ASV scan reports with passing status
- Confirm remediation rescans for critical/high findings
Compliance frameworks
Is your environment compliant with this rule?
CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.
Related Cross-cloud rules
- Block storage volumes must be encrypted
- Cache service security hardening
- Cache services must enforce TLS encryption in transit
- Container registry security hardening
- Database authentication must use managed identities
- Databases must not be publicly accessible
- IAM password policy must require minimum length of 14
- Key management service security hardening