Question 1

What evidence do auditors ask for on RA-5(3) Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage. Define the breadth and depth of vulnerability scanning coverage?

Accepted Answer

The documented definition of breadth and depth of vulnerability scanning coverage, stating which components and which vulnerability classes are in scope; Scanner configuration showing the target scope and the checks enabled, matched against that definition; Scan results demonstrating the defined breadth was actually reached, with an accounted list of assets not scanned; Reconciliation of scan targets against the system component inventory; Evidence of authenticated scanning where depth requires it, and the credentials scope used.

Question 2

Can RA-5(3) be evidenced continuously rather than by periodic review?

Accepted Answer

Automate the pull from your Vulnerability scanner / patch tooling. Scan schedule, findings and remediation age straight from the scanner; patch compliance from the patch console.

Question 3

What is the most common gap auditors find on RA-5(3)?

Accepted Answer

Breadth and depth asserted from the tool default rather than defined by the organisation, which is exactly what this enhancement requires

`RA-5(3)` Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage. Define the breadth and depth of vulnerability scanning coverage

system holds itEvidence a system already holds

periodic reviewEvidence produced at each review

governing documentDocuments that govern the control

First move

Common gaps auditors find

Do this for your whole sheet