RA-5(8) Vulnerability Monitoring and Scanning | Review Historic Audit Logs
Review historic audit logs to determine if a vulnerability identified in a FedRAMP-defined system has been previously exploited within a FedRAMP-defined time period.
3
artefacts
1
held by a system
1
at each review
moderate
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Log retention evidence covering the defined lookback period · SIEM / log platform
periodic reviewEvidence produced at each review
- Completed retrospective reviews with their conclusions · Policy repository / GRC workspace
governing documentDocuments that govern the control
- Procedure linking a new vulnerability finding to a retrospective log review · Policy repository / GRC workspace
First move
Start with the 1 of 3 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Log retention shorter than the lookback period the procedure claims
- Retrospective review done only after a major incident rather than as routine
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetRA-5(5) Privileged Access · RA-5(11) Vulnerability Monitoring and Scanning | Public Disclosure Program. Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components