RA-5(6)

Requirement

Compare the results of multiple vulnerability scans using [Assignment: organization-defined automated mechanisms].

Discussion

Using automated mechanisms to analyze multiple vulnerability scans over time can help determine trends in system vulnerabilities and identify patterns of attack.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Risk assessment policy; procedures addressing vulnerability scanning; system design documentation; vulnerability scanning tools and techniques documentation; vulnerability scanning results; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with vulnerability scanning responsibilities; organizational personnel with vulnerability scan analysis responsibilities; organizational personnel with security responsibilities].

Test

[SELECT FROM: Organizational processes for vulnerability scanning; automated mechanisms/tools supporting and/or implementing vulnerability scanning; automated mechanisms supporting and/or implementing trend analysis of vulnerability scan results].

ID	Assessment Objectives
RA-05(06)	the results of multiple vulnerability scans are compared using <RA-05(06)_ODP automated mechanisms>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!