The ASV is REQUIRED to investigate false positives with a CVSS Base score at or below 3.9 (a passing score).

The ASV is REQUIRED to investigate false positives with a CVSS Base score at or below 3.9 (a passing score).

• A. True
• B. False
• C. Not specified
• D. Not applicable

Answer: (B)

CVSS scores are used to prioritize which vulnerabilities need careful validation and remediation. In the PCI ASV process, the focus is on higher-severity findings, since those pose a greater risk to cardholder data. Low-severity results (base score 3.9 or below) are considered lower risk, so the formal requirement to investigate potential false positives is not applied to those passing-score items. In other words, false positives with a CVSS base score at or below 3.9 are not mandated to be investigated by the ASV as part of the standard practice. This is why the statement is not correct.

CVSS scores are used to prioritize which vulnerabilities need careful validation and remediation. In the PCI ASV process, the focus is on higher-severity findings, since those pose a greater risk to cardholder data. Low-severity results (base score 3.9 or below) are considered lower risk, so the formal requirement to investigate potential false positives is not applied to those passing-score items. In other words, false positives with a CVSS base score at or below 3.9 are not mandated to be investigated by the ASV as part of the standard practice. This is why the statement is not correct.