After significant changes, what must be done regarding vulnerability scanning?

• A. Scans after significant changes
• B. Scans optional after changes
• C. Scans must be performed and rescanned until criteria are met
• D. Scans during change window should be avoided

Answer: (C)

Vulnerability scanning must be performed after significant changes and then rescanned until remediation criteria are met. This ensures that any new components or configuration changes don’t introduce new vulnerabilities and that fixes have actually been verified. PCI DSS requires regular scans (at least quarterly) and mandates a follow-up scan after significant changes to confirm that identified vulnerabilities have been addressed to the defined acceptance standards. So it isn’t optional or a one-time check; it’s a process of scanning, remediating, and re-scanning until the targets are satisfied.