If your payment processor has asked for a passing ASV scan, you are not alone. An ASV scan is one of the most common PCI requirements hotels run into, and one of the least explained. This guide covers what an ASV scan is, whether your hotel needs one, what happens during a scan and what to do if you fail.

What Is an ASV Scan?

An ASV scan is an external vulnerability scan of your internet-facing systems, performed by an Approved Scanning Vendor (ASV). ASVs are companies approved by the PCI Security Standards Council to run these scans using an approved scanning solution.

The scan looks at your property from the outside, the way an attacker on the internet would. It checks the public IP addresses and websites connected to your payment environment for known weaknesses: outdated software, risky open ports, weak encryption settings and similar problems.

Under the PCI Data Security Standard, merchants who need ASV scans must have them done at least once every three months, and each quarter’s scan must pass.

Does Your Hotel Need Quarterly ASV Scans?

It depends on which Self-Assessment Questionnaire (SAQ) your property completes. According to the PCI Security Standards Council, ASV scans are included for merchants completing SAQ A, A-EP, B-IP, C and D. SAQ B, SAQ C-VT and SAQ P2PE do not include them.

For a typical hotel, that means:

IP-connected card terminals (SAQ B-IP): ASV scans apply.
A PMS or POS with integrated payments connected to the internet (SAQ C or D): ASV scans apply.
A validated point-to-point encryption (P2PE) solution only (SAQ P2PE): ASV scans do not apply.

Your payment processor confirms which SAQ applies to you. If you are not sure, our article on which PCI SAQ your hotel uses walks through each one.

What Happens During an ASV Scan

Scoping. You list every public IP address and domain that belongs in the scan. That includes the internet connection your terminals use, plus any web pages involved in taking payments. As the merchant, you are responsible for making sure the scope is complete.
Scanning. The ASV’s tool tests each target from the internet. Scans are designed not to disrupt normal operations, but scheduling them for a quiet period is good practice.
Results. You receive a report listing every finding, a pass or fail result for each target and an overall result.
Fix and rescan. If anything fails, it must be fixed and rescanned until the result is a pass.
Attestation. A passing scan comes with an attestation from the ASV, which you keep with your SAQ and provide to your processor if asked.

Why Hotels Fail ASV Scans

A failing result rarely means you have been hacked. It means the scanner found a known weakness that an attacker could use. At hotels, the usual causes are:

Outdated firewall or router firmware with published security flaws
Remote access left open, often set up years ago for a PMS, phone or camera vendor
Old encryption settings on web portals, email or VPN services
Admin login pages exposed to the internet on cameras, video recorders or phone systems
Forgotten devices still sitting on a public IP address

What to Do If Your ASV Scan Fails

Start by matching each finding to the system it belongs to, then send it to whoever manages that system: your IT provider, your internet provider or the vendor of the PMS, phone system or cameras. Most fixes are routine, such as a firmware update, a firewall rule change or switching off an old service. Once the fixes are in, run the rescan.

If you believe a finding is wrong, for example a false positive, you can dispute it with the ASV. You will need evidence, such as configuration screenshots or vendor documentation.

Do not leave a failing scan sitting. Some processors charge a monthly non-compliance fee until compliance is shown, and the weakness the scan found is real until it is fixed.

ASV Scan vs Penetration Test

The two are often confused. An ASV scan is an automated check for known vulnerabilities on your public-facing systems. A penetration test is a hands-on attempt by a qualified tester to break in. Many smaller hotels completing SAQ B-IP or SAQ C need ASV scans but not a full penetration test. Merchants on SAQ D have additional testing requirements.

Make Quarterly Scans Painless

Most hotels do not fail because the fixes are hard. They fail because nobody owns the calendar, nobody can read the report and every vendor points at someone else. Our PCI readiness check and managed ASV scanning service handles the scheduling, explains every result in plain language and runs the rescans until you pass. For the bigger picture, read our guide to PCI compliance for hotels.

Book a PCI readiness check or call 226-476-3358.