The primary purpose of the PCI DSS audit is to validate an organization's ability to protect cardholder data and all systems that interact with payment transactions.

PCI SSC has developed controls to protect electronic or physical forms of payment, with or without a card transactions.

If you have a website where you get credit card numbers directly from your visitors, you must comply with PCI DSS requirements, and one of those requirements is PCI compliance scans.

The PCI DSS requirements apply to all system components, including people, processes and technologies that store, process or transmit cardholder data or sensitive authentication data, included in or connected to the cardholder data environment.

The firewall rule base must be reviewed at least quarterly and the change management process created to add and push the policy to the firewall.

Vulnerabilities are constantly found by malicious individuals and researchers, and new software is introduced to them. System components, processes, and custom applications should be periodically reviewed to ensure an evolving environment continues to represent security controls.