To comply with the standard governing the security of payment transaction environments, organizations are required to run both internal and external vulnerability scans on a quarterly basis and additionally after any significant change in the network. This practice helps in the timely identification and remediation of vulnerabilities to protect sensitive customer payment information. Scanning every two years is not frequent enough, and limiting activity to external scans neglects potential internal security threats. While annual penetration tests are also required, they are distinct from vulnerability scanning and do not substitute the need for more frequent scans. Relying solely on preventative measures like firewalls does not fulfill the mandated scanning requirements.