RA-5 (1) Vulnerability Scanning | Update Tool Capability (M) (H)

NIST 800-53 (r4) Control:

The organization employs vulnerability scanning tools that include the capability to readily update the information system vulnerabilities to be scanned.

NIST 800-53 (r4) Supplemental Guidance:

The vulnerabilities to be scanned need to be readily updated as new vulnerabilities are discovered, announced, and scanning methods developed. This updating process helps to ensure that potential vulnerabilities in the information system are identified and addressed as quickly as possible. Related controls: SI-3, SI-7.

NIST 800-53 (r5) Discussion:

Withdrawn: Incorporated into RA-5.

38North Guidance:

Meets Minimum Requirement:

• Vulnerability scanning tools are up-to-date with the latest updates or plugins depending on the scanning tool.

Best Practice:

• Vulnerability scanning tools are configured to update automatically, when applicable, depending on the ability of the tool.

• Vulnerability scanning tools are monitored by authorized personnel to ensure the most current versions are installed for the FedRAMP environment.

Unofficial FedRAMP Guidance: None

Assessment Evidence:

• Screen shots that demonstrate vulnerability scanning tools are operating at the latest versions/plugins.

CSP Implementation Tips:

• Amazon Web Services (AWS): TBD

• Microsoft Azure: TBD

• Google Cloud Platform: TBD