800-53 · RA Risk Assessment
RA-5
Vulnerability Monitoring and Scanning
frameworkNIST SP 800-53 Rev 5.2
sectionRA Risk Assessment
csf 2.0GV.SC-10 ID.IM-01 ID.IM-02 ID.IM-03 ID.RA-01 ID.RA-08
topicsVulnerability Mgmt
frameworks7 6 0
Official texta. Monitor and scan for vulnerabilities in the system and hosted applications [Assignment: organization-defined organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported;
b. Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
1. Enumerating platforms, software flaws, and improper configurations;
2. Formatting checklists and test procedures; and
3. Measuring vulnerability impact;
c. Analyze vulnerability scan reports and results from vulnerability monitoring;
d. Remediate legitimate vulnerabilities [Assignment: organization-defined response times] in accordance with an organizational assessment of risk;
e. Share information obtained from the vulnerability monitoring process and control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other systems; and
f. Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.NIST SP 800-53 Rev 5.2 control statement (public domain)
b. Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
1. Enumerating platforms, software flaws, and improper configurations;
2. Formatting checklists and test procedures; and
3. Measuring vulnerability impact;
c. Analyze vulnerability scan reports and results from vulnerability monitoring;
d. Remediate legitimate vulnerabilities [Assignment: organization-defined response times] in accordance with an organizational assessment of risk;
e. Share information obtained from the vulnerability monitoring process and control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other systems; and
f. Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.NIST SP 800-53 Rev 5.2 control statement (public domain)
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | ID.RA-01ID.RA-08 | Vulnerabilities in assets are identified, validated, and recorded; Processes for receiving, analyzing, and responding to vulnerability disclosures are established | Crosswalk | Same topic: Vulnerability Mgmt1 loosely related (not mappings)GV.SC-10 Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement Only shares CSF GV.SC-10: related, not a mapping |
| ISO 27001 | A.8.8 | Management of technical vulnerabilities | Crosswalk | Same topic: Vulnerability Mgmt7 loosely related (not mappings)A.5.19 Information security in supplier relationships Only shares CSF GV.SC-10, ID.IM-02: related, not a mapping Clause 6.1.2 Information security risk assessment Only shares CSF GV.SC-10, ID.RA-08: related, not a mapping A.5.20 Addressing information security within supplier agreements Only shares CSF GV.SC-10: related, not a mapping A.5.21 Managing information security in the ICT supply chain Only shares CSF GV.SC-10: related, not a mapping A.5.22 Monitoring, review and change management of supplier services Only shares CSF GV.SC-10: related, not a mapping |
| CIS v8.1 | CIS 7.1CIS 7.2CIS 7.5CIS 7.6CIS 7.7CIS 16.6CIS 18.1CIS 18.2CIS 18.3CIS 18.4CIS 18.5 | Establish and Maintain a Vulnerability Management Process; Establish and Maintain a Remediation Process… | Crosswalk | Same topic: Vulnerability Mgmt1 loosely related (not mappings) |
| SOC 2 | CC7.1 | Detecting configuration changes and new vulnerabilities | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
| PCI DSS | 6.3.111.3.111.3.2 | Vulnerabilities identified and risk-ranked; Internal vulnerability scans every three months… | Crosswalk | Same topic: Vulnerability Mgmt16 loosely related (not mappings)11.4.4 Penetration test findings corrected and retested Only shares CSF ID.IM-02, ID.RA-01: related, not a mapping 12.3.4 Hardware and software technologies reviewed annually Only shares CSF GV.SC-10, ID.IM-01: related, not a mapping 1.2.4 Accurate account-data flow diagram maintained Only shares CSF GV.SC-10: related, not a mapping 3.2.1 Account data storage minimised, with retention and disposal Only shares CSF GV.SC-10: related, not a mapping 6.3.2 Inventory of custom software and its components Only shares CSF ID.RA-01: related, not a mapping 6.4.3 Payment page scripts authorised and integrity-checked Only shares CSF GV.SC-10: related, not a mapping …and 8 more in the downloads |
| CMMC | RA.L2-3.11.2RA.L2-3.11.3 | Vulnerability Scan; Vulnerability Remediation | Crosswalk | Same topic: Vulnerability Mgmt7 loosely related (not mappings)RA.L2-3.11.1 Risk Assessments Only shares CSF GV.SC-10, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping CA.L2-3.12.1 Security Control Assessment Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping CA.L2-3.12.3 Security Control Monitoring Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping CM.L2-3.4.9 User-Installed Software Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SI.L2-3.14.6 Monitor Communications for Attacks Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping SI.L2-3.14.7 Identify Unauthorized Use Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping |
| HIPAA | §164.308(a)(8)§164.308(a)(1)(ii)(A)§164.308(a)(1)(ii)(B) | Evaluation; Risk Analysis… | Crosswalk | Same topic: Vulnerability Mgmt10 loosely related (not mappings)§164.316(a) Policies and Procedures Only shares CSF GV.SC-10, ID.IM-01, ID.IM-02, ID.IM-03…: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping §164.316(b) Documentation Only shares CSF ID.IM-01, ID.IM-02, ID.IM-03, ID.RA-01: related, not a mapping §164.308(b)(4) Written Contract or Other Arrangement Only shares CSF GV.SC-10, ID.IM-03: related, not a mapping §164.314(a) Business Associate Contracts or Other Arrangements Only shares CSF GV.SC-10, ID.IM-03: related, not a mapping §164.314(a)(2)(i) Business Associate Contracts Only shares CSF GV.SC-10, ID.IM-03: related, not a mapping §164.314(a)(2)(iii) Business associate contracts with subcontractors Only shares CSF GV.SC-10, ID.IM-03: related, not a mapping §164.308(b)(1) Business Associate Contracts and Other Arrangements Only shares CSF GV.SC-10: related, not a mapping …and 2 more in the downloads |
| GDPR | Art.32(1)(d) | Security of processing | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
| NIS2 | 6.56.10 | Security testing; Vulnerability handling and disclosure | Crosswalk | Same topic: Vulnerability Mgmt |
| Essential Eight | ISM-1698ISM-1699ISM-1701ISM-1702ISM-1807ISM-1808 | A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online…; A vulnerability scanner is used at least weekly to identify missing patches or updates…… | Editorial | Same topic: Vulnerability Mgmt (editorial pick)23 loosely related (not mappings)ISM-0304 Applications other than office productivity suites, web browsers and their extensions… Only shares CSF ID.RA-01: related, not a mapping ISM-1407 The latest release, or the previous release, of operating systems are used Only shares CSF ID.RA-01: related, not a mapping ISM-1501 Operating systems that are no longer supported by vendors are replaced Only shares CSF ID.RA-01: related, not a mapping ISM-1690 Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of… Only shares CSF ID.RA-01: related, not a mapping ISM-1691 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release Only shares CSF ID.RA-01: related, not a mapping ISM-1692 Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48… Only shares CSF ID.RA-01: related, not a mapping ISM-1693 Patches, updates or other vendor mitigations for vulnerabilities in applications other… Only shares CSF ID.RA-01: related, not a mapping ISM-1694 Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks… Only shares CSF ID.RA-01: related, not a mapping …and 15 more in the downloads |
| DORA | Art.8(2)Art.25(1)Art.26(1)Art.27(1) | Identification; Testing of ICT tools and systems… | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
| CPS 234 | Para 17Para 27Para 30 | Keep capability current as threats and vulnerabilities change; Systematic testing programme for control effectiveness… | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
| Cyber Essentials | CE 3 | Security Update Management | Editorial | Same topic: Vulnerability Mgmt (editorial pick) |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.