Navigate

RA-5

RA-5: Vulnerability Scanning

The organization:

a: Scans for vulnerabilities in the information system and hosted applications [organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system/applications are identified and reported;

b: Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
- 1: Enumerating platforms, software flaws, and improper configurations;
- 2: Formatting checklists and test procedures; and
- 3: Measuring vulnerability impact;

c: Analyzes vulnerability scan reports and results from security control assessments;

d: Remediates legitimate vulnerabilities [organization-defined response times] in accordance with an organizational assessment of risk; and

e: Shares information obtained from the vulnerability scanning process and security control assessments with [organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).

Supplemental

Security categorization of information systems guides the frequency and comprehensiveness of vulnerability scans. Organizations determine the required vulnerability scanning for all information system components, ensuring that potential sources of vulnerabilities such as networked printers, scanners, and copiers are not overlooked. Vulnerability analyses for custom software applications may require additional approaches such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Organizations can employ these analysis approaches in a variety of tools (e.g., web-based application scanners, static analysis tools, binary analyzers) and in source code reviews. Vulnerability scanning includes, for example: (i) scanning for patch levels; (ii) scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and (iii) scanning for improperly configured or incorrectly operating information flow control mechanisms. Organizations consider using tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention and that use the Open Vulnerability Assessment Language (OVAL) to determine/test for the presence of vulnerabilities. Suggested sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD). In addition, security control assessments such as red team exercises provide other sources of potential vulnerabilities for which to scan. Organizations also consider using tools that express vulnerability impact by the Common Vulnerability Scoring System (CVSS).

CIA Levels
Confidentiality	high
Integrity	high
Availability	high

Overlays
None

CSF Categories
DE.CM-8, DE.DP-4, DE.DP-5, ID.RA-1, PR.IP-12, RS.CO-3, RS.MI-3

Related Controls

The controls below (if any) were marked by NIST as being related to RA-5.

Control	Description
CA-2	The organization: a: Develops a security assessment plan that describes the scope of the assessment including: 1: Security controls and control enhancements under assessment; 2: Assessment procedures to be used to determine security control effectiveness; and 3: Assessment environment, assessment team, and assessment roles and responsibilities; b: Assesses the security controls in the information system and its environment of operation [organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements; c: Produces a security assessment report that documents the results of the assessment; and d: Provides the results of the security control assessment to [organization-defined individuals or roles].
CA-7	The organization develops a continuous monitoring strategy and implements a continuous monitoring program that includes: a: Establishment of [organization-defined metrics] to be monitored; b: Establishment of [organization-defined frequencies] for monitoring and [organization-defined frequencies] for assessments supporting such monitoring; c: Ongoing security control assessments in accordance with the organizational continuous monitoring strategy; d: Ongoing security status monitoring of organization-defined metrics in accordance with the organizational continuous monitoring strategy; e: Correlation and analysis of security-related information generated by assessments and monitoring; f: Response actions to address results of the analysis of security-related information; and g: Reporting the security status of organization and the information system to [organization-defined personnel or roles] [organization-defined frequency].
CM-4	The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.
CM-6	The organization: a: Establishes and documents configuration settings for information technology products employed within the information system using [organization-defined security configuration checklists] that reflect the most restrictive mode consistent with operational requirements; b: Implements the configuration settings; c: Identifies, documents, and approves any deviations from established configuration settings for [organization-defined information system components] based on [organization-defined operational requirements]; and d: Monitors and controls changes to the configuration settings in accordance with organizational policies and procedures.
RA-2	The organization: a: Categorizes information and the information system in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance; b: Documents the security categorization results (including supporting rationale) in the security plan for the information system; and c: Ensures that the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.
RA-3	The organization: a: Conducts an assessment of risk, including the likelihood and magnitude of harm, from the unauthorized access, use, disclosure, disruption, modification, or destruction of the information system and the information it processes, stores, or transmits; b: Documents risk assessment results in []; c: Reviews risk assessment results [organization-defined frequency]; d: Disseminates risk assessment results to [organization-defined personnel or roles]; and e: Updates the risk assessment [organization-defined frequency] or whenever there are significant changes to the information system or environment of operation (including the identification of new threats and vulnerabilities), or other conditions that may impact the security state of the system.
SA-11	The organization requires the developer of the information system, system component, or information system service to: a: Create and implement a security assessment plan; b: Perform [one or more of unit/integration/system/regression] testing/evaluation at [organization-defined depth and coverage]; c: Produce evidence of the execution of the security assessment plan and the results of the security testing/evaluation; d: Implement a verifiable flaw remediation process; and e: Correct flaws identified during security testing/evaluation.
SI-2	The organization: a: Identifies, reports, and corrects information system flaws; b: Tests software and firmware updates related to flaw remediation for effectiveness and potential side effects before installation; c: Installs security-relevant software and firmware updates within [organization-defined time period] of the release of the updates; and d: Incorporates flaw remediation into the organizational configuration management process.

Enhancements

The controls below (if any) add on to the requirements of RA-5.

Control	Description
RA-5(1)	The organization employs vulnerability scanning tools that include the capability to readily update the information system vulnerabilities to be scanned.
RA-5(2)	The organization updates the information system vulnerabilities scanned [one or more of {{ insert: param, ra-5.2_prm_2 }} /prior to a new scan/when new vulnerabilities are identified and reported].
RA-5(3)	The organization employs vulnerability scanning procedures that can identify the breadth and depth of coverage (i.e., information system components scanned and vulnerabilities checked).
RA-5(4)	The organization determines what information about the information system is discoverable by adversaries and subsequently takes [organization-defined corrective actions].
RA-5(5)	The information system implements privileged access authorization to [organization-identified information system components] for selected [organization-defined vulnerability scanning activities].
RA-5(6)	The organization employs automated mechanisms to compare the results of vulnerability scans over time to determine trends in information system vulnerabilities.
RA-5(7)
RA-5(8)	The organization reviews historic audit logs to determine if a vulnerability identified in the information system has been previously exploited.
RA-5(9)
RA-5(10)	The organization correlates the output from vulnerability scanning tools to determine the presence of multi-vulnerability/multi-hop attack vectors.

Related CCIs

The CCIs below are tied to RA-5.

CCI	Definition
CCI-001054	Monitor and scan for vulnerabilities in the system and hosted applications on an organization-defined frequency and/or randomly in accordance with organization-defined process.
CCI-001055	Defines a frequency for scanning for vulnerabilities in the system and hosted applications, and/or randomly in accordance with organization-defined process.
CCI-001056	Monitor and scan for vulnerabilities in the system and hosted applications when new vulnerabilities potentially affecting the system/applications are identified and reported.
CCI-001057	Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: enumerating platforms, software flaws, and improper configurations.
CCI-001058	Analyze vulnerability scan reports and results from vulnerability monitoring.
CCI-001059	Remediate legitimate vulnerabilities in organization-defined response times in accordance with an organizational assessment risk.
CCI-001060	Defines response times for remediating legitimate vulnerabilities in accordance with an organization assessment of risk.
CCI-001061	Share information obtained from the vulnerability monitoring process and control assessments with organization-defined personnel or roles to help eliminate similar vulnerabilities in other systems.
CCI-001641	Defines the process for conducting random vulnerability scans on the system and hosted applications.
CCI-001643	Monitor and scan for vulnerabilities in the system and hosted applications in accordance with the organization-defined process for random scans.
CCI-002376	Defines the personnel or roles with whom the information obtained from the vulnerability monitoring process and control assessments will be shared.