Services · Cyprus
PCI DSS ASV scans in Cyprus via a PCI SSC-approved partner. Tetramatrix coordinates scope, reports, remediation and rescans.
Published Updated
Tetramatrix coordinates PCI DSS external vulnerability scans for merchants and service providers in Cyprus. The scan is performed through a PCI Security Standards Council (PCI SSC)-approved Approved Scanning Vendor (ASV) partner. We help define the in-scope external assets, prepare the scan, explain the result and coordinate the steps needed to validate remediation.
An ASV scan is one part of a payment security programme. It checks agreed internet-facing systems for exposure that may affect the security of a cardholder-data environment. Businesses that store, process or transmit payment card data may have scanning obligations under their PCI DSS validation route. Requirements depend on the merchant or service-provider environment and the rules applied by the acquiring bank and Qualified Security Assessor (QSA), so we confirm the expected scope before work begins.
The assessment can cover public IP addresses, domains, hostnames and network services that are declared in scope. Depending on the exposed assets, checks can identify open ports, known vulnerabilities, outdated or exposed services, and SSL/TLS or other security misconfigurations. Findings are assessed through the applicable ASV programme criteria and presented with enough context for the technical team to investigate.
Before scanning, we work with your team to assemble the asset list and check that targets are reachable and correctly associated with your payment environment. This helps surface missing or unavailable targets before the scan cycle is under way. We also clarify exclusions and ownership so that the scan is authorised and limited to the approved scope.
PCI DSS Requirement 11.3.2 calls for passing external ASV scans at least once every 3 months for applicable in-scope environments, with rescans as needed to confirm that vulnerabilities have been resolved. Additional scanning may be required after significant changes to the network or payment environment. We can coordinate the agreed quarterly schedule, plan an additional scan after a change, and discuss more frequent checks where your risk programme calls for them. See the PCI SSC’s ASV scanning guidance for the requirement and scope considerations.
“At least once every three months.”
PCI Security Standards Council, Requirement 11.3.2 guidance
The scan cycle includes scope confirmation, readiness checks, execution, review of findings and reporting. The delivery partner may use automated scheduling, parallel scanning and retries for temporarily unavailable targets, subject to the approved scope and service arrangement. Straightforward scans are typically reported within 24–48 hours after target submission; larger scopes, unreachable assets or follow-up analysis can extend the turnaround. Scheduling is agreed in advance so your team can prepare for scan traffic and respond to questions about assets.
If a scan identifies findings, we help your team understand the reported asset, issue and applicable PCI outcome. The technical owners can then patch software, update configuration, close an unnecessary service or otherwise address the exposure. Tetramatrix can coordinate a validation rescan so the ASV can confirm whether the change has resolved the finding.
Some results may require further investigation because a finding is disputed or an asset is outside the cardholder-data environment. We can help organise the technical evidence and coordinate a formal dispute or scope clarification through the ASV process. The scanning provider assesses the dispute and records the outcome; the merchant remains responsible for maintaining accurate scope and remediation records.
The service provides scan results in a report format suitable for review by your internal technical team and for discussion with your acquirer or QSA. Reports can include an executive summary, detailed findings, affected hosts and ports, severity information and remediation status. Depending on the selected portal options, authorized users can review a compliance score, attack-surface summary and open findings alongside fixes validated by later scans, then export an interactive report or PDF evidence pack. Where the in-scope scan achieves a passing result, the ASV process can produce an Attestation of Scan Compliance (ASC) for the applicable PCI evidence workflow.
For organisations managing several businesses or clients, the portal can support separated client workspaces, role-based access, structured onboarding and branded reporting where enabled. The service environment provides safeguards such as encryption in transit and at rest, multi-factor authentication or single sign-on options, and audit logs; available access and regional hosting options depend on the agreed service configuration.
An ASV report supports a PCI DSS validation process; it does not itself certify the entire organisation as PCI compliant. Your acquiring bank, QSA or other responsible assessor determines which evidence and validation method apply. We can help coordinate report delivery and keep scan, remediation and rescan records together for the next review.
Tetramatrix is your local point of contact in Cyprus for scope preparation, scheduling and remediation coordination. The scanning activity and formal ASV result are provided through a PCI SSC-approved scanning partner. That distinction keeps responsibilities clear: the ASV operates the approved scan and issues the formal result, while we help your organisation prepare and act on it.
The service suits e-commerce businesses, retailers, hospitality companies, payment service providers and other organisations whose PCI DSS obligations include external ASV scanning. It can also support IT teams and compliance advisers managing scan evidence for more than one authorised entity, with each environment scoped separately.
We begin with a short review of your payment environment, current PCI validation route, external IP addresses and domains, existing scan schedule and the person responsible for technical remediation. We then confirm the assets and authorisation, arrange the scan, share the findings with the right owners and coordinate any needed validation. If you are unsure whether an asset belongs in scope or whether ASV scanning applies to your business, we can help prepare the questions for your acquiring bank or QSA before scanning starts.
An Approved Scanning Vendor scan is an external vulnerability assessment used by many merchants and service providers to meet PCI DSS scanning requirements. It examines the internet-facing assets agreed for the cardholder-data environment and provides a result against the applicable ASV criteria. Your acquiring bank or QSA can confirm the requirements for your validation route.
Tetramatrix scopes and coordinates the service, while the scan itself is performed by a PCI SSC-approved ASV partner. We help prepare the asset list, arrange the scan cycle and coordinate remediation and validation steps.
PCI DSS generally requires quarterly external ASV scanning for in-scope environments and may require a scan after significant network changes. The precise scope and evidence schedule should be confirmed with your acquiring bank or QSA.
The agreed scope can include public IP addresses, domains and internet-facing services that are relevant to your payment environment. We review ownership, reachability and scope boundaries with your team before a scan is scheduled.
You receive findings assessed against the applicable ASV criteria with remediation information. Tetramatrix can coordinate your technical team's fixes, a validation rescan and, where appropriate, supporting evidence for a formal false-positive or scope dispute. A passing attestation is issued only when the ASV process records a passing result.
No. An ASV scan is a PCI-focused external vulnerability scan against a defined set of internet-facing assets. A penetration test uses a separately agreed scope and methodology to assess how vulnerabilities or weaknesses could be combined and exploited.
Tell us what you need — we reply within one business day.
