How often should you run vulnerability scans? PCI DSS, HIPAA, CIS and insurance

The short version:

• PCI DSS requires internal and external scans at least every three months and after significant changes.
• HIPAA does not set a frequency today, but regular scanning supports the required risk analysis.
• Monthly authenticated scanning is a sensible baseline for most small and mid-sized clients.
• Scan internet-facing systems more often than internal ones.

The short answer

At least quarterly to meet most compliance requirements, monthly as a practical baseline, and continuously or weekly for internet-facing systems where you can. Then scan again after any significant change, such as a new firewall, a new server or a major upgrade.

PCI DSS

• Internal scans at least once every three months and after significant change (requirement 11.3.1), performed with authentication (11.3.1.2), with high-risk and critical vulnerabilities resolved and rescanned.
• External scans at least once every three months by a PCI SSC Approved Scanning Vendor (ASV), with a passing result (11.3.2), plus scans after significant change.

ASV scans are a specific service with their own attestation; a general vulnerability report is not a substitute for one.

HIPAA

The HIPAA Security Rule requires covered entities and business associates to perform an accurate and thorough risk analysis and to implement reasonable safeguards, but it does not name a scan frequency. Regular vulnerability scanning is the standard way to support that risk analysis with evidence. Proposed updates to the Security Rule published in early 2025 would add explicit vulnerability scanning and penetration testing requirements; check the status of that rulemaking for your clients.

CIS Controls and other frameworks

• CIS Controls v8, Control 7: automated authenticated and unauthenticated scans of internal assets at least quarterly (7.5), externally exposed assets at least monthly (7.6), and risk-based remediation at least monthly (7.7).
• SOC 2 and ISO 27001: no fixed interval, but auditors expect a defined cadence that you can show was followed.
• Cyber Essentials (UK): focuses on patching within 14 days for high and critical updates rather than a scan schedule.

Cyber insurance

Underwriting questionnaires increasingly ask whether you scan regularly, whether internet-facing systems are covered and how quickly critical vulnerabilities are patched. Requirements vary by insurer and policy, so read the client's application. The most useful evidence is a dated history of reports showing findings being fixed.

Setting a cadence per client

A practical starting cadence

A higher cadence is only useful if the reports get read. Match scan frequency to how often the client can act, and use remediation SLAs to keep the two in step. Varaxon Scan Hub keeps every report per client, so a monthly cadence builds the dated evidence trail auditors and insurers ask for.

Common questions

Is an annual vulnerability scan enough?

Rarely. New vulnerabilities are published every day and many are exploited within weeks. Annual scanning leaves most of the year unmeasured and does not meet PCI DSS or CIS Controls expectations.

Should I rescan after patching?

Yes. A rescan confirms the fix worked and gives you evidence that the finding was resolved, which PCI DSS explicitly requires for high-risk and critical internal findings.

This guide first appeared on varaxontech.com.

I'm building Varaxon Scan Hub. It turns exports from Nessus, Greenbone/OpenVAS, Qualys, Rapid7, Nuclei, Burp, Defender and other network, host and web scanners into clear, client-ready reports, and can open HaloPSA or ConnectWise tickets after you review them. Your first three reports are free, and a free pre-flight check shows what it can read from your export first.

— Brandon Sooknanan
Founder, Varaxon Technologies