The PCI DSS standard requires most businesses and organizations that process card information to perform quarterly vulnerability scans. Such formal scans must be performed by a PCI Approved Scanning Vendor (ASV). However, businesses and organizations should perform vulnerability scans (both web and network scans) much more often to be truly secure.
Learn about PCI DSS vulnerability scan requirements.