PCI ASV CVSS Scoring Engine and Pass/Fail Gate

Guard includes a built-in PCI Approved Scanning Vendor (ASV) scoring engine that evaluates scan results against the requirements of the PCI DSS ASV Program Guide. After each scan, the engine produces a deterministic pass/fail verdict per component and a rolled-up overall verdict that feeds ASV reporting workflows.

How scoring works

After a scan completes, a post-processing stage evaluates every finding using the ASV-specified CVSS source order defined in PCI DSS ASV Program Guide Table 1:

1. NVD CVSS v3.1
2. NVD CVSS v3.0
3. NVD CVSS v2.0
4. ASV-calculated CVSS v3.1

Guard selects the first available score in this sequence for each finding. This follows the program guide's prescribed precedence rather than defaulting to the highest available version or highest available score.

Pass/fail gate

A finding receives a fail verdict under either of the following conditions:

Component-level verdicts are rolled up to a single overall verdict for the scan. A single failing finding is sufficient to fail the overall result.

Auto-fail vulnerability classes

Nine vulnerability classes defined by the PCI ASV Program Guide result in an unconditional fail regardless of CVSS score. These classes are mapped to pinned CWE data to ensure consistent, auditable identification across scans.

Results in Guard

Scoring results are surfaced per component in the scan output. Each component shows:

• The resolved CVSS score and the source from which it was drawn
• Whether the finding matched an auto-fail class
• The component-level pass/fail verdict
• The rolled-up overall verdict

Foundation for ASV reporting

The scoring engine is the underlying layer for Guard's ASV reporting capability. Scope evaluation rules and the full ASV report output build on the verdicts produced here. Completing a scan with this engine engaged is a prerequisite for generating a compliant ASV report.