# PCI ASV Scan Copilot

> Walks a PCI ASV user through the full three-month external scan cycle for network and web application targets — scan setup, launch and monitoring, finding review grouped by PCI DSS v4.0.1 requirement, dispute candidate identification, and a preliminary attestation readiness check.

- Type: Skill
- Author: jdelong-tenb
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-10-13
- Source repository: https://github.com/jdelong-tenb/pci-asv-scan-copilot
- Repo state: not archived
- Last push: 2026-10-08T13:22:15Z
- Stars: 0 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable
- Domains: vulnerability-management, governance-risk-compliance
- Tags: pci-dss, vulnerability-management, web-application-scanning, asv-scanning, compliance, attestation
- Date added: 2026-08-31
- Compatible platforms: Claude Code
- Invocation: `Say things like "help me set up my quarterly PCI ASV scan," "I need to run a PCI external vulnerability scan," "scan my payment web app for PCI," "which PCI findings can I dispute," or "am I ready to submit my attestation" — the skill activates automatically.`
- Listing page: https://exchange.tenable.com/skills/pci-asv-scan-copilot
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/pci-asv-scan-copilot.md

## What it does

PCI DSS v4.0.1 Requirement 11.3.2 mandates external vulnerability scans of your cardholder data environment (CDE) at least once every three months by an Approved Scanning Vendor (ASV). The places users get stuck — scan template selection, target scoping (including web application URLs), interpreting which findings block attestation versus which are disputable, compensating controls framing, and knowing when to submit — are what this skill covers, against your real Tenable account state.

This is a community-built skill, not official Tenable support and not PCI DSS compliance advice. Consult your QSA for authoritative compliance interpretation.

**Scope:** PCI external vulnerability scanning (ASV) of network/host targets (Tenable Vulnerability Management) and public-facing web applications via the PCI-scoped web application scan in the PCI workbench (a PCI-limited WAS scan, not the full Tenable Web App Scanning product), as well as any externally facing system component that may provide access to the CDE (ASV Program Guide section 5.5). Does not cover internal scans, penetration testing, or other PCI DSS requirements. The customer owns scope.

## Before you start

- Tenable recommends no more than 5,000 assets per PCI scan; larger imports can fail or take hours. (Tenable PCI ASV User Guide, p. 104)
- PCI licensing counts unique IP addresses; web application FQDNs are resolved to IPs. The check happens when you submit an attestation, and an attestation whose asset count exceeds your licensed count is rejected (Tenable PCI ASV User Guide, pp. 11-13).
- The PCI ASV license includes the Nessus and WAS scanners with the PCI scan templates. The PCI web application template only covers the minimal PCI requirements, and Tenable recommends a full Web App Scanning license to scan and monitor web applications fully (Tenable PCI ASV User Guide, p. 14).
- You cannot create an attestation for a scan more than 90 days old, and dispute activity must finish before the scan report's 90-day expiration (Tenable PCI ASV User Guide, pp. 107-108).
- Each rescan is a separate scan and must be imported into the workbench. Passing results from several scans can be aggregated into one report for the period (ASV Program Guide sections 7.3 and 7.4).
- You cannot edit or delete a dispute once the attestation is submitted. Cloning a dispute deletes the other disputes on the same attestation.
- If your subscription expires during the review period, Tenable cannot complete the report.
- The attestation is the customer's and cannot be outsourced. Evidence prepared with help, including from this skill, must be reviewed and attested by the customer (ASV Program Guide section 5.2).
- The ASV may discover extra domains or IPs (for example through MX records, redirects, or crawling). You must scan them or declare them out of scope (ASV Program Guide section 5.5.3).
- Shared hosting: coordinate scan interference with your ISP or host, or obtain the provider's passing scans (ASV Program Guide section 5.5.2).
- The final report is submitted per the payment brands' reporting requirements; ask your acquirer or payment brand where (ASV Program Guide section 7.9).

## How it connects

The skill works through Tenable's MCP, the REST API, or both. One API key pair (sent as an `X-ApiKeys` header) serves both, and the key must belong to an Administrator. Keep keys in environment variables or your OS keychain, never in a repository.

- **MCP (primary).** Endpoint `https://cloud.tenable.com/mcp`. The skill uses it for template and policy lookup, creating, launching and monitoring the network scan, and reading results and plugin details. Tested on 2026-10-07: template lookup (`policy_templates`), `policy_list_policies`, `scan_create` with `asv`, `scan_launch`, `scan_status`, `scan_list_scans`, `scan_results`, `plugins_get_plugin_details`, and `workbenches_get_vulnerability_outputs`.
- **REST API (optional, for the web application scan).** The MCP has no web application scanning tools, so the optional scripted route uses the Web App Scanning v2 API: `GET /was/v2/templates` (find the `pci` template), `POST /was/v2/configs` (needs `name`, `owner_id` from `GET /session`, `template_id`, and a top-level `targets` list of public URLs), `POST /was/v2/configs/{config_id}/scans` to launch, `GET /was/v2/scans/{scan_id}` to poll, and `GET /was/v2/scans/{scan_id}/notes` for the reason if a scan aborts. Tested on 2026-10-07: create, launch, status polling, completion, and workbench import (the imported scan appeared with `scan_type` `was` and its failure count). Private targets are rejected. For REST calls, the agent needs shell access (for example `curl`) and reads the keys from the `TIO_ACCESS_KEY` and `TIO_SECRET_KEY` environment variables; never print or log them.
- **PCI ASV API.** `GET /pci-asv/scans` lists scans imported into the workbench (tested, read-only). Submitting through the API was not tested.
- **PCI ASV Workbench (UI).** Importing scans, creating and submitting the attestation, and disputes happen here. Use "Import to ASV Workbench" in the scan list row menu.
- **Both together.** A typical run is the network scan through MCP, the web application scan in the workbench (or through the WAS v2 REST API if you want to script it), import of both in the UI, then results review through MCP with web application findings supplied by you.

## How it works

Install the skill into your Claude Code skills directory. When invoked, it uses Tenable MCP tools (and optionally the WAS REST API) to walk you through five phases:

1. **Scan setup** — checks existing policies (`policy_list_policies`) only to spot reuse of the wrong template, and checks available templates (`policy_templates`), looking templates up at run time rather than hardcoding names. The submitted scan always uses the unmodified PCI Quarterly External Scan template. It then helps scope targets for your external-facing CDE components.
   - **Two scans, not one.** A Nessus Scanner scan using "PCI Quarterly External Scan" (template `asv`) for IP addresses and ranges, and a Web Application scan using the PCI-scoped WAS template ("PCI ASV" in the workbench picker; shown as "PCI" in Tenable documentation) for web application FQDNs entered as URLs such as http://www.example.com. Both can be imported into the PCI ASV Workbench, but the workbench requires a PCI WAS scan to be combined with a PCI Quarterly External Scan before submitting for ASV review (in New Scan Results, select both scans and click Start Attestation; the workbench will not start an attestation for a web application scan unless a PCI Quarterly External scan is included, Tenable PCI ASV User Guide p. 107, which points to the knowledge base article "How To Combine multiple PCI ASV Scans"). You may also see an "Internal PCI Network Scan" tile in the VM scan template list; it is not submittable.
   - **Scope questions.** It asks for IPs and ranges plus every fully qualified domain name, virtual host, and web application URL in scope, including URLs that cannot be reached by crawling from the home page (ASV Program Guide v4.0 r2 section 5.5).
   - **Your responsibility.** PCI expects a web application scan whenever you have public-facing web applications in the CDE, but the skill cannot verify your scope. It reminds you; deciding what is in scope and whether to run the web application scan is the customer's responsibility.
   - **Internal scans are separate.** PCI DSS also requires internal scans at least once every three months. They use the "Internal PCI Network Scan" template (template `pci`), run on the Vulnerability Management side like any other scan, and can double as a practice run before the real scan. They cannot be imported into the PCI workbench, so they are never submitted for ASV review. The skill can point you to the template but does not manage or track internal scans; that is the customer's responsibility. Tenable PCI ASV customers are required to own a full Tenable One Vulnerability Management license, which is where internal scans run (Tenable PCI ASV User Guide, p. 13). It never uses the `pci` template for the submitted scan.
   - **Permissions.** Only Administrator users can perform the scanning steps (Tenable PCI ASV documentation, Get Started).
2. **Launch and monitor** — covers both scans and getting them into the workbench.
   - **Network scan.** Can create and launch it with `scan_create` (template `asv`) and `scan_launch`, then monitor with `scan_status`. Creating a scan with `scan_create` (template `asv`) was tested on 2026-10-07 and works; it returns the new scan's ID as plain text, and the same template also works through the REST API (`POST /scans`). It was also launched with `scan_launch` and monitored with `scan_status` to completion (status moves running, publishing, completed; a scan against an unroutable address took about 16 minutes on the Tenable cloud scanner, which was chosen automatically). A completed scan does not appear in the PCI ASV Workbench by itself: import it from the VM scan list (row menu, "Import to ASV Workbench"). In testing, the imported scan then appeared in `GET /pci-asv/scans` with `scan_type` nessus and `import_status` complete. Otherwise create it from the workbench (Create Scan > PCI Quarterly External Scan). The API key used must belong to an Administrator. The ASV manages the scan solution, and customers may not modify checks, severities, or scan parameters (ASV Program Guide section 5.2).
   - **Web application scan.** Guides you through creating, launching, and monitoring it in the PCI workbench ("Create a Scan - PCI WAS Scan"), or, if you prefer, through the WAS v2 REST API. In the workbench it needs a Name and Targets entered as URLs. This is a PCI-limited scan, not general Web App Scanning, and the skill does not use general WAS scan templates for it. The Tenable VM MCP has no web application scanning tools (its `scan_create` builds VM scans only). The WAS API also rejects private targets (for example http://10.0.0.133) with "Private target ... is not allowed" (tested 2026-10-07), so web application targets must be publicly reachable.
   - **Import into the workbench.** Each completed scan, including rescans (each rescan is a new scan), must be imported into the PCI ASV Workbench before it can be attached to an attestation. For web application scans, use "Import to ASV Workbench" in the WAS scan row menu.
   - **Web application testing rules.** Unauthenticated testing is the PCI minimum (ASV Program Guide section 6, Table 1, Web Applications). Tenable advises against adding credentials to PCI ASV scans; discuss authenticated testing with your ASV before considering it.
   - **WAF/IPS.** For the scan window only, configure active protection systems (for example, IPS or rate-based WAF rules) to monitor and log, but not block, the ASV scanner IPs, or to consistently pass non-attack traffic; reapply the normal configuration when the scan finishes. No allow-listing or extra access is required. A scan left inconclusive because of interference is reported as failed (ASV Program Guide sections 5.6 and 7.6).
3. **Review findings** — pulls completed network scan results (`scan_results`, `scan_host_details` (untested), `plugins_get_plugin_details`). For the web application scan, it works from findings you export or paste from the Web App Scanning scan, because the Tenable VM MCP has no WAS tools. It groups findings by PCI DSS v4.0.1 requirement with plain-language explanations and CVSS scores. Findings are never collapsed by plugin alone: the same web application plugin firing on different URLs or parameters is a separate, legitimate finding, so the skill keeps URL, parameter, and plugin output with each finding.
4. **Dispute candidates** — identifies false positives, disputed CVSS scores, and compensating control candidates with documentation guidance per finding type. Each dispute is assessed per finding (per URL and parameter for web application findings), never per plugin, using raw scanner output from `workbenches_get_vulnerability_outputs` where it strengthens or weakens the case. Recast rules do not apply to results from the two ASV templates, so disputes are the route for contested findings. The ASV, not you or this skill, decides whether a dispute is accepted (ASV Program Guide sections 7.7 and 7.8).
5. **Attestation readiness** — issues a preliminary readiness assessment (pass/conditional/fail with specific action items) based on the network scan results it can read and the web application and dispute information you provide. The ASV's review in the workbench is the only authoritative result. If a PCI WAS scan is part of the submission, it also confirms you have combined it with a PCI Quarterly External Scan in the workbench (not tested by this skill). It checks asset coverage against the scan's host list (`scan_results`/`scan_host_details`); it uses `scan_list_scans` to look for prior completed PCI ASV scans and flag gaps; hosts with no findings are expected to be absent from `workbenches_list_assets_with_vulnerabilities`. It counts unresolved failing findings (CVSS base score 4.0 or higher, plus automatic failures that fail regardless of CVSS score), and tracks days since scan completion against the 90-day expiry and the three-month next-scan deadline, reporting whichever comes first (see below).

## What you do in the PCI ASV Workbench

The skill does not create or submit attestations. After both scans are imported and combined (the workbench requires a PCI WAS scan to be combined with a PCI Quarterly External Scan before submission), you create an attestation draft, mark assets that are not in the CDE out of scope (you are attesting they are segmented from the CDE, and the ASV reports excluded components on the attestation; ASV Program Guide sections 7.3 and 5.5.3), open a dispute for each failure (a failure left undisputed at submission makes the ASV reviewer fail the attestation), and submit for ASV review (Tenable PCI ASV documentation, Get Started). One dispute in the workbench can cover several failures that share a plugin ID, but the evidence must cover every attached URL or host. With Tenable PCI ASV, disputes are handled in the PCI ASV Workbench, and Tenable does not provide in-depth consulting on fixes (Tenable PCI ASV documentation, Welcome page).

Includes a utility script (`scripts/list_pci_scans.py`) to list existing PCI scans and available templates before you start.

## What counts as a failure

- Any vulnerability with a CVSS base score of 4.0 or higher fails the scan (ASV Program Guide sections 6.2.1 and 6.3.2, Table 2). ASVs score with CVSS v3.1, falling back to v3.0 and then v2.0 as the guide describes (if there is no NVD score, the ASV calculates CVSS v3.1). The skill uses the plugin's CVSS v3.x score as an estimate; the score in the ASV report governs. The skill checks the CVSS score for every finding, not just the High severity ones.
- Certain findings are automatic failures regardless of CVSS score (ASV Program Guide section 6.3.3 exception 4 and Table 1). For web applications these include SQL injection, cross-site scripting, directory traversal, and HTTP response splitting or header injection. For network components they include backdoors/malware, default accounts and passwords, unrestricted DNS zone transfers, unsupported operating systems, SSL/early TLS, and internet-reachable cardholder-data databases (ASV Program Guide Table 1). The skill flags these separately and does not downgrade them on a low CVSS score.
- A purely denial-of-service vulnerability (for example, CVSS confidentiality and integrity impact both "None") is not ranked as a failure (ASV Program Guide section 6.3.3 exception 3). The ASV applies this exception; the skill only flags it as a likely non-failure.
- Missing patches for High or Medium findings must be installed or covered by a compensating control; "no patch is available" is not itself an exception (ASV Program Guide section 7.7 note).
- Special Notes to Scan Customer: the ASV must declare the report FAILED until all applicable declarations are obtained and reviewed (ASV Program Guide section 7.2), while Special Notes alone do not cause a scan failure or supersede CVSS scoring (ASV Program Guide section 6.1, footnote 1).
- Load balancers: the ASV needs your documented assurance that the environment behind them is synchronized, or it adds a Special Note to the report (ASV Program Guide section 6.1).

## How disputes work

- Disputes go to your ASV; the ASV evaluates them and documents the outcome in the report. You cannot edit the report, and disputes are not submitted to PCI SSC (ASV Program Guide sections 7.7 and 7.10).
- Evidence should be system generated (screen captures, configuration files, version and patch lists) with a description of when, where, and how it was obtained, and you attest that it is accurate and complete (ASV Program Guide section 7.7).
- Dispute outcomes are not carried forward: evidence is resubmitted and re-evaluated for each scan period (ASV Program Guide section 7.7).
- With Tenable PCI ASV, disputes are created and tracked in the PCI ASV Workbench.

## Scan cycle and rescans

PCI DSS 11.3.2 and the ASV Program Guide (section 5.1) require passing external scans at least once every three months, with rescans as needed to show vulnerabilities are resolved. The three-month cycle is not a calendar-quarter rule. The skill reports both the completion date and the date three months later as your next-scan deadline. Each ASV scan report carries a scan expiration date 90 days after the scan completes (ASV Program Guide, Appendix A, A.3). Tenable's workbench enforces the same window: you cannot create an attestation for a scan more than 90 days old, and dispute activity must be completed before the report's 90-day expiration (Tenable PCI ASV User Guide, Create an Attestation, pp. 107-108). Disputes must be resolved and the attestation finalized while the scan is still valid; otherwise a new scan is needed. The skill tracks days since scan completion against this date and reports whichever comes first: the 90-day expiry or the three-month next-scan deadline. Multiple failing scans can be aggregated into one passing report for the scan period (ASV Program Guide sections 7.3 and 7.4). After any significant change, an external scan with CVSS base score 4.0 or higher findings resolved is also required (PCI DSS 11.3.2.1); this scan need not be performed by an ASV, but must be done by qualified, independent personnel.

## Requirement mapping notes

Finding-to-requirement mapping is a hardcoded table in the skill, because scanner plugins do not carry PCI DSS cross-references. Examples: weak TLS and certificates map to 4.2.1; software and OS patching to 6.3.3; SQL injection and cross-site scripting in custom web applications to 6.2.4; default credentials to 2.2.2; unnecessary exposed services to 2.2.4 and 1.2.5 (1.3.1 where the service is in the CDE; 1.3.2 covers outbound traffic). Confirm any mapping with your QSA.

## Known limitations

- The PCI web application scan is limited to PCI scope, and the Tenable VM MCP has no tools for it (checked against its tool list on 2026-10-07). By default the skill guides you through creating it in the PCI workbench. It can also use the WAS v2 REST API (`POST /was/v2/configs`, `POST /was/v2/configs/{config_id}/scans`, `GET /was/v2/scans/{scan_id}`), which was tested end to end on 2026-10-07 with import through the WAS scan row menu. Importing through the API was not tested. Web application findings for review are supplied by you.
- Tested on 2026-10-07: network scan creation, launch, completion and workbench import (`scan_create` with `asv`, `scan_launch`, `scan_status`, then "Import to ASV Workbench"), and WAS `pci` configuration creation, launch (`POST /was/v2/configs/{config_id}/scans`), polling, completion (about two hours against a deliberately vulnerable test site) and workbench import. Not tested: combining the two scans, attestation, disputes, submission, and API-based import, which happen in the PCI ASV Workbench and with the ASV.
- Not yet tested: `scan_host_details` and `workbenches_list_assets_with_vulnerabilities`; confirm they exist in your MCP tool list.
- Scope completeness relies on what you tell the skill. It can only verify the targets you put into the scan.
- ASV scan reports, attestation, and dispute decisions come from your ASV, not from this skill.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/pci-asv-scan-copilot.json. The full index and how to read it: https://exchange.tenable.com/llms.txt