PCI-FAQ

^{Last updated: 2026-10-13}

PCI ASV Scanning FAQ

Answers to common questions about PCI compliance scanning in the Outpost24 Platform, covering environments, scopes, assets, scanning, reporting, attestation and online payments.

For the full walkthrough, see PCI-Scanning.

For everything about findings, disputes and ASV special notes, see PCI-findings.

Access and Prerequisites

Where do I find PCI scanning in the Portal?

Navigate to PCI Environments in the Main Menu. The Environments view lists all of your PCI environments.

Is there anything I need before I create an environment?

A schedule is required, but it can be created at the same time as the environment. If you wish to preconfigure a schedule, see Schedules.

Environments

What is an environment?

An environment describes one cardholder data environment and the timings for when it must be scanned. It also holds the company contact information that is printed on the ASV report. Each environment produces scopes using the schedule that was created.

What does the Deadline column show?

The number of days remaining in the 90-day compliance window, counted from the completion date of the last completed scope. The value shows as days left or days overdue, with a warning colour  at 30 days or less and an alert colour at 7 days or less.

Why is the Deadline column empty?

A dash is shown when no scope has been completed yet, so there is no completion date to count from.

Why does PCI DSS require a scan every 90 days?

PCI DSS requires a passing external scan at least every 90 days. This tracks as a deadline on each environment, counted from the date the last scope was completed. For further details on PCI DSS requirements, see https://www.pcisecuritystandards.org/standards/pci-dss/ or contact your QSA.

What is the customer information used for?

It is included in the final ASV report. By default the organisation details from the account are used; however, for accuracy we advise filling in the details here.

Can I use different contact details for one environment?

Yes. Uncheck Use organisation defaults and complete the fields: company name, contact name, contact e-mail, phone, address, postal code, city, country, and state or region. Only fields that are changed are stored as overrides, and cleared fields revert to the organisation defaults.

How do I edit an environment?

Open the Environment, click the kebab menu  and select Edit.

You can also right-click an Environment and select Edit.

Can I delete an environment?

Yes, but only if it doesn’t contain a completed scan from within the last 3 years. Select Delete from the kebab menu and confirm. An environment that contains a completed scope scanned within the last three years cannot be deleted, because PCI compliance data is retained for three years.

Scopes

What is a scope?

A scope is simply one scan cycle of assets with an attestation cycle. A scope is created, assets are discovered, reviewed and confirmed, scanned, and finally completed with an attestation.

Why do my scopes not have names?

Scopes are not named by design. Each scope is identified by its creation date, for example 6 Jul 2026. Each environment should have a single scope per attestation cycle.

How is a scope created?

New scopes are normally created automatically by the environment's schedule. Create one manually with Create scope to start a cycle immediately.

What can I enter as a scan target?

One target per line. Each line can be an IP address, a hostname, a CIDR block, an IP range, or a host with virtual hosts. 

What happens during a Scopes Discovery scan?

A number of things happen during the Discovery phase:

• Check for connectivity to the scoped assets.

• Look up any hostnames and virtual hosts.

• Look up relevant DNS entries which could potentially exist in the Cardholder Data Environment (CDE).

Why can I not create a new scope?

A new scope requires the previous scope to be COMPLETED. This applies to scheduled cycles as well: the schedule starts the next cycle at its next occurrence, only after the current scope has been completed.

Do my assets carry over into the next scope?

Yes. In-scope assets from the previous scope are carried over into the new one.

Can I change the targets after creating a scope?

Yes, while the scope is READY FOR REVIEW. Select Edit scope from the kebab menu. Saving restarts asset discovery. You can also select Run discovery to re-run discovery on the current target list without changing it.

Can I delete a scope?

Any scope that is not COMPLETED can be deleted. Completed scopes cannot be deleted.

Which actions are available on a scope?

Assets

What is an asset?

A host discovered inside a scope. Each asset is either in scope or not in scope for the compliance scan.

How do I include or exclude an asset?

Use the In scope toggle on each row. Changes are saved immediately. Use the All / In scope / Not in scope filter above the table to review your selection.

What can I edit on an asset?

Select Edit asset from its kebab menu. The name, the virtual hosts and the seed URLs are editable, one value per line. The IP address is read-only.

What are virtual hosts?

Additional host names served from the same IP address. The scan covers each one individually.

What are seed URLs?

Known entry points on an asset that are given to the scanner as a starting place.

What happens if I exclude an asset?

It is not assessed. Full PCI DSS compliance requires all publicly reachable parts of the cardholder data environment to be in scope.

Can I change the in-scope selection after confirming?

No. After confirmation the in-scope selection cannot be changed for that scope. Asset names, virtual hosts and seed URLs remain editable, and individual in-scope assets can still be rescanned from the asset's kebab menu.

Confirming and Scanning

What does confirming the scope do?

It locks the asset selection and starts, or schedules, the compliance scan. The dialog states how many assets are included. At least one asset must be in scope to confirm.

When does the scan start?

Either immediately, or on a date you choose with Schedule for later. A scheduled scan starts at the current time of day on the chosen date, and the date must be within two weeks from today.

Can I cancel a scheduled scan?

Yes. Click Cancel scheduled scan, for example to make changes before scanning. The scope stays confirmed.

What do I see while discovery or a scan is running?

Clicking the scope during discovery or while scanning opens a status page:

• Discovering assets - the system is identifying all assets within scope.

• Scanning for compliance - the system is evaluating the in-scope assets against PCI DSS requirements. A View assets link shows the asset list in the meantime.

• Scheduled - a compliance scan is queued, with its start time shown.

Results and Compliance

What makes a scope COMPLIANT?

Three conditions must all hold:

1. The latest scan on every in-scope asset finished successfully.

2. Every finding is either compliant or has an accepted dispute.

3. Every ASV special note has been answered.

To see the Status of scans, and too ensure they were all successful, select Scans in the Menu. PCI scans will be tabled as such in the ‘Source’ column.

Why is my scope still NON COMPLIANT after I fixed the findings?

A scope is NON COMPLIANT when at least one finding is failing or a special note still needs a response. Check for unanswered special notes as well as findings in a FAILED state.

What is a failing finding?

A result from the compliance scan on an in-scope asset that blocks completion until it is remediated or its dispute is accepted.

Where do I raise a dispute?

Disputes and ASV special notes are covered in PCI Findings and Disputes.

Rescanning

How do I rescan after remediating?

Select Rescan & rediscover from the scope's kebab menu. The dialog offers two options that can be combined, and at least one must be selected.

What is the difference between the two options?

Do my disputes survive a rescan?

Yes. Disputes and their statuses are preserved across rescans.

Reports and Completing a Scope

What is a draft report?

A report generated on demand and marked PCI PREVIEW. It omits the attestation sections and is intended for internal review before finalising. Drafts can be re-generated as many times as needed.

Can I generate a draft report on a NON COMPLIANT scope?

Yes. Create report is available on both COMPLIANT and NON COMPLIANT scopes. Only final submission requires the scope to be COMPLIANT.

Where do my generated reports appear?

Reports are displayed in the Downloads section when ready. The final report also remains available from the scope's Download report action.

What is final submission?

It completes the scope . Select Final submission, check the confirmation box, then click Finalize and submit report.

What am I confirming when I attest?

The confirmation box reads: "I confirm the scope is complete and the report is ready for final submission." This is the customer attestation that dispute evidence is accurate, that all in-scope infrastructure is included, and that special notes have been appended.

What happens when I finalise?

The scope status changes to COMPLETED, the attestation is recorded with the confirming user and date, and the final ASV report is generated and stored.

Can I undo a final submission?

No. Finalising is irreversible. A completed scope is locked: its assets, findings, special notes and disputes cannot be modified, and no further scans can run in it. The next scan cycle takes place in a new scope.

Can the final report be regenerated?

No. The final report is generated once, at completion time, and is never regenerated. The stored file is the document of record for the attestation.

After Completion

When does the next cycle start?

The next scope is created automatically at the next schedule occurrence, carrying the in-scope assets forward, or manually with Create scope.

What happens to the 90-day deadline?

The environment's 90-day deadline restarts from the completion date.

How long is my compliance data kept?

PCI compliance data is retained for three years. Completed scopes older than three years are removed automatically; the environment itself remains.

Online Payments

How do I cancel my subscription?

Log in to your 2Checkout account to cancel the renewal of your subscription.

My renewal failed, who should I contact?

Contact our payment provider, 2Checkout.

Scope Status Reference

Status values are displayed exactly as the system defines them. Clicking a scope row opens the page that matches its current status.