Navigate

CCI-001641

CCI-001641 Definition

Defines the process for conducting random vulnerability scans on the system and hosted applications.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

DoD has defined the requirement for vulnerability scanning periodicity of every 30 days. If the organization being inspected/assessed has determined a requirement for random scanning they must document that process. DoD has defined the frequency as every 30 days or as directed by an authoritative source (e.g. IAVM, CTOs, DTMs, STIGs).

Validation Procedures

The organization conducting the inspection/assessment obtains and examines random vulnerability process documentation (if applicable) to validate the organization has clearly defined and documented a process for conducting random vulnerability scans on the information system and hosted applications. If the organization being inspected/assessed has determined they have no requirement for random scanning, there is no requirement for a process.

Compelling Evidence

1.) System security plan (SSP). 2.) Reference to system security plan (SSP) section pertaining to vulnerability scanning procedures.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-001641.

Control	Description
RA-5	The organization: a: Scans for vulnerabilities in the information system and hosted applications [organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system/applications are identified and reported; b: Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: 1: Enumerating platforms, software flaws, and improper configurations; 2: Formatting checklists and test procedures; and 3: Measuring vulnerability impact; c: Analyzes vulnerability scan reports and results from security control assessments; d: Remediates legitimate vulnerabilities [organization-defined response times] in accordance with an organizational assessment of risk; and e: Shares information obtained from the vulnerability scanning process and security control assessments with [organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).

Control

Description

RA-5

The organization:

a: Scans for vulnerabilities in the information system and hosted applications [organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system/applications are identified and reported;

b: Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
- 1: Enumerating platforms, software flaws, and improper configurations;
- 2: Formatting checklists and test procedures; and
- 3: Measuring vulnerability impact;

c: Analyzes vulnerability scan reports and results from security control assessments;

d: Remediates legitimate vulnerabilities [organization-defined response times] in accordance with an organizational assessment of risk; and

e: Shares information obtained from the vulnerability scanning process and security control assessments with [organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).