RA-5 Vulnerability monitoring and scanning
Requires vulnerability monitoring and scanning of the system and hosted applications at a defined frequency or randomly by a defined process and when new relevant vulnerabilities are reported, using tools and techniques
5
artefacts
4
held by a system
1
at each review
easy
to go live
Vulnerability scanner / patch tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Scan schedule and coverage evidence across the system and hosted applications · Vulnerability scanner / patch tooling
- Scan reports with findings ranked by severity · Vulnerability scanner / patch tooling
- Records of scan result distribution to the defined personnel · Vulnerability scanner / patch tooling
- Configuration showing authenticated or privileged scanning where required · Vulnerability scanner / patch tooling
periodic reviewEvidence produced at each review
- Defined remediation timeframes by risk level and evidence they are met · Policy repository / GRC workspace
governing documentDocuments that govern the control
none for this control
First move
Automate the pull from your Vulnerability scanner / patch tooling. Scan schedule, findings and remediation age straight from the scanner; patch compliance from the patch console.
Common gaps auditors find
- Unauthenticated scanning only, which understates the real vulnerability position
- Remediation timeframes defined but routinely exceeded with no risk acceptance
- Coverage gaps for containers, cloud services and short lived infrastructure
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetRA-3 Risk assessment · RA-6 Technical Surveillance Countermeasures Survey. Employ a technical surveillance countermeasures survey at [organization-defined] [organization-defined]