Please refer to troubleshooting failures of PCI scan reports
Note for a site hosted by Blackbaud, this finding is what's known as a "false positive" i.e. not a true vulnerability.