RA-5(2)

Requirement

Update the system vulnerabilities to be scanned [Selection (one or more): [Assignment: organization-defined frequency]; prior to a new scan; when new vulnerabilities are identified and reported].

Discussion

Due to the complexity of modern software, systems, and other factors, new vulnerabilities are discovered on a regular basis. It is important that newly discovered vulnerabilities are added to the list of vulnerabilities to be scanned to ensure that the organization can take steps to mitigate those vulnerabilities in a timely manner.

Title

Vulnerability Monitoring and Scanning | Update Vulnerabilities to Be Scanned
Family

Risk Assessment
NIST 800-53B Baseline(s)
- Low
- Moderate
- High

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Procedures addressing vulnerability scanning; assessment report; vulnerability scanning tools and associated configuration documentation; vulnerability scanning results; patch and vulnerability management records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with vulnerability scanning responsibilities; organizational personnel with vulnerability scan analysis responsibilities; organizational personnel with security responsibilities; system/network administrators].

Test

[SELECT FROM: Organizational processes for vulnerability scanning; mechanisms/tools supporting and/or implementing vulnerability scanning].

ID	Assessment Objectives
RA-05(02)	the system vulnerabilities to be scanned are updated <RA-05(02)_ODP[01] SELECTED PARAMETER VALUES>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!