1. Home
  2. FedRAMP
  3. RA-5

BRACKETOLOGY | FEDRAMP

RA-5: VULNERABILITY SCANNING

  • FedRAMP Baseline Membership RA-5:
  • LOW
  • MODERATE
  • HIGH

FedRAMP Bracketology

Use the FedRAMP Control Membership information above to determine if a control or control enhancement is required for each Impact Baseline — LOW, MODERATE, or HIGH

Click on the panel below each control or control enhancement to review the FedRAMP Impact Baseline-specific control configuration requirements for each of the [BRACKETS] in each control and/or control enhancement.

Review and use Additional Requirements and Guidance to build FedRAMP-compliant controls for your risk-based cybersecurity program.

To change the baseline view in the panel, click on LOW, MODERATE, or HIGH when the panel is open

Panels only appear where there are [BRACKETS] in the control or enhancement or where there is FedRAMP-specific requirements or guidance available.

The organization:

    • a. Scans for vulnerabilities in the information system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system/applications are identified and reported;
    • b. Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
      1. Enumerating platforms, software flaws, and improper configurations;
      2. Formatting checklists and test procedures; and
      3. Measuring vulnerability impact;
    • c. Analyzes vulnerability scan reports and results from security control assessments;
    • d. Remediates legitimate vulnerabilities [Assignment: organization-defined response times] in accordance with an organizational assessment of risk; and
    • e. Shares information obtained from the vulnerability scanning process and security control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).

Click Low | Moderate | High below to see FedRAMP control configuration information. It's in BOLD.

The organization:

  • a. Scans for vulnerabilities in the information system and hosted applications monthly operating system/infrastructure; monthly web applications and databases and when new vulnerabilities potentially affecting the system/applications are identified and reported;
  • b. Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
    1. Enumerating platforms, software flaws, and improper configurations;
    2. Formatting checklists and test procedures; and
    3. Measuring vulnerability impact;
  • c. Analyzes vulnerability scan reports and results from security control assessments;
  • d. Remediates legitimate vulnerabilities high-risk vulnerabilities mitigated within thirty (30) days from date of discovery; moderate risk vulnerabilities mitigated within ninety (90) days from date of discovery in accordance with an organizational assessment of risk; and
  • e. Shares information obtained from the vulnerability scanning process and security control assessments with organization-defined personnel or roles to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).

FedRAMP REQUIREMENT:

RA-5a.: An accredited independent assessor scans operating systems/infrastructure, web applications, and databases once annually.

RA-5e.: To include the Risk Executive; for JAB authorizations to include FedRAMP ISSOs

The organization:

  • a. Scans for vulnerabilities in the information system and hosted applications monthly operating system/infrastructure; monthly web applications and databases and when new vulnerabilities potentially affecting the system/applications are identified and reported;
  • b. Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
    1. Enumerating platforms, software flaws, and improper configurations;
    2. Formatting checklists and test procedures; and
    3. Measuring vulnerability impact;
  • c. Analyzes vulnerability scan reports and results from security control assessments;
  • d. Remediates legitimate vulnerabilities high-risk vulnerabilities mitigated within thirty (30) days from date of discovery; moderate risk vulnerabilities mitigated within ninety (90) days from date of discovery in accordance with an organizational assessment of risk; and
  • e. Shares information obtained from the vulnerability scanning process and security control assessments with organization-defined personnel or roles to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).

FedRAMP REQUIREMENT:

RA-5a.: An accredited independent assessor scans operating systems/infrastructure, web applications, and databases once annually.

RA-5e.: To include the Risk Executive; for JAB authorizations to include FedRAMP ISSOs

The organization:

  • a. Scans for vulnerabilities in the information system and hosted applications monthly operating system/infrastructure; monthly web applications and databases and when new vulnerabilities potentially affecting the system/applications are identified and reported;
  • b. Employs vulnerability scanning tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
    1. Enumerating platforms, software flaws, and improper configurations;
    2. Formatting checklists and test procedures; and
    3. Measuring vulnerability impact;
  • c. Analyzes vulnerability scan reports and results from security control assessments;
  • d. Remediates legitimate vulnerabilities high-risk vulnerabilities mitigated within thirty (30) days from date of discovery; moderate risk vulnerabilities mitigated within ninety (90) days from date of discovery in accordance with an organizational assessment of risk; and
  • e. Shares information obtained from the vulnerability scanning process and security control assessments with organization-defined personnel or roles to help eliminate similar vulnerabilities in other information systems (i.e., systemic weaknesses or deficiencies).

FedRAMP REQUIREMENT:

RA-5a.: An accredited independent assessor scans operating systems/infrastructure, web applications, and databases once annually.

RA-5e.: To include the Risk Executive; for JAB authorizations to include FedRAMP ISSOs

SUPPLEMENTAL GUIDANCE

Security categorization of information systems guides the frequency and comprehensiveness of vulnerability scans. Organizations determine the required vulnerability scanning for all information system components, ensuring that potential sources of vulnerabilities such as networked printers, scanners, and copiers are not overlooked. Vulnerability analyses for custom software applications may require additional approaches such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Organizations can employ these analysis approaches in a variety of tools (e.g., web-based application scanners, static analysis tools, binary analyzers) and in source code reviews. Vulnerability scanning includes, for example: (i) scanning for patch levels; (ii) scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and (iii) scanning for improperly configured or incorrectly operating information flow control mechanisms. Organizations consider using tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention and that use the Open Vulnerability Assessment Language (OVAL) to determine/test for the presence of vulnerabilities. Suggested sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD). In addition, security control assessments such as red team exercises provide other sources of potential vulnerabilities for which to scan. Organizations also consider using tools that express vulnerability impact by the Common Vulnerability Scoring System (CVSS).

CONTROL ENHANCEMENTS

RA-5 (1) VULNERABILITY SCANNING | UPDATE TOOL CAPABILITY
  • FedRAMP Baseline Membership RA-5 (1):
  • MODERATE
  • HIGH

The organization employs vulnerability scanning tools that include the capability to readily update the information system vulnerabilities to be scanned.

Supplemental Guidance:

The vulnerabilities to be scanned need to be readily updated as new vulnerabilities are discovered, announced, and scanning methods developed. This updating process helps to ensure that potential vulnerabilities in the information system are identified and addressed as quickly as possible.

RELATED CONTROLS: RA-5 (1)

RA-5 (2) VULNERABILITY SCANNING | UPDATE BY FREQUENCY / PRIOR TO NEW SCAN / WHEN IDENTIFIED
  • FedRAMP Baseline Membership RA-5 (2):
  • MODERATE
  • HIGH

The organization updates the information system vulnerabilities scanned [Selection (one or more): [Assignment: organization-defined frequency]; prior to a new scan; when new vulnerabilities are identified and reported].

Click Low | Moderate | High below to see FedRAMP control configuration information. It's in BOLD.

There are no FedRAMP-specific requirements if this control is used for a LOW Impact system.

The organization updates the information system vulnerabilities scanned prior to a new scan.

The organization updates the information system vulnerabilities scanned prior to a new scan.


Supplemental Guidance: NONE

RELATED CONTROLS: RA-5 (2)

RA-5 (3) VULNERABILITY SCANNING | BREADTH/DEPTH OF COVERAGE
  • FedRAMP Baseline Membership RA-5 (3):
  • MODERATE
  • HIGH

The organization employs vulnerability scanning procedures that can identify the breadth and depth of coverage (i.e., information system components scanned and vulnerabilities checked).

Supplemental Guidance: NONE

RA-5 (4) VULNERABILITY SCANNING | DISCOVERABLE INFORMATION
  • FedRAMP Baseline Membership RA-5 (4):
  • HIGH

The organization determines what information about the information system is discoverable by adversaries and subsequently takes [Assignment: organization-defined corrective actions].

Supplemental Guidance:

Click Low | Moderate | High below to see FedRAMP control configuration information. It's in BOLD.

There are no FedRAMP-specific requirements if this control is used for a LOW Impact system.

There are no FedRAMP-specific requirements if this control is used for a MODERATE Impact system.

The organization determines what information about the information system is discoverable by adversaries and subsequently takes notify appropriate service provider personnel and follow procedures for organization and service provider-defined corrective actions.


Discoverable information includes information that adversaries could obtain without directly compromising or breaching the information system, for example, by collecting information the system is exposing or by conducting extensive searches of the web. Corrective actions can include, for example, notifying appropriate organizational personnel, removing designated information, or changing the information system to make designated information less relevant or attractive to adversaries.

RELATED CONTROLS: RA-5 (4)

RA-5 (5) VULNERABILITY SCANNING | PRIVILEGED ACCESS
  • FedRAMP Baseline Membership RA-5 (5):
  • MODERATE
  • HIGH

The information system implements privileged access authorization to [Assignment: organization-identified information system components] for selected [Assignment: organization-defined vulnerability scanning activities].

Click Low | Moderate | High below to see FedRAMP control configuration information. It's in BOLD.

There are no FedRAMP-specific requirements if this control is used for a LOW Impact system.

The information system implements privileged access authorization to operating systems, databases, web applications for all scans.

The information system implements privileged access authorization to operating systems, databases, web applications for all scans.


Supplemental Guidance:

In certain situations, the nature of the vulnerability scanning may be more intrusive or the information system component that is the subject of the scanning may contain highly sensitive information. Privileged access authorization to selected system components facilitates more thorough vulnerability scanning and also protects the sensitive nature of such scanning.

RA-5 (6) VULNERABILITY SCANNING | AUTOMATED TREND ANALYSES
  • FedRAMP Baseline Membership RA-5 (6):
  • MODERATE
  • HIGH

The organization employs automated mechanisms to compare the results of vulnerability scans over time to determine trends in information system vulnerabilities.

Click Low | Moderate | High below to see FedRAMP control configuration information. It's in BOLD.

There are no FedRAMP-specific requirements if this control is used for a LOW Impact system.

There are no FedRAMP-specific BRACKET requirements if this control is used for a MODERATE Impact system.

The organization employs automated mechanisms to compare the results of vulnerability scans over time to determine trends in information system vulnerabilities.

FedRAMP GUIDANCE:

HIGH & MODERATE: Include in Continuous Monitoring ISSO digest/report to JAB/AO.<./p>

There are no FedRAMP-specific BRACKET requirements if this control is used for a HIGH Impact system.

The organization employs automated mechanisms to compare the results of vulnerability scans over time to determine trends in information system vulnerabilities.

FedRAMP GUIDANCE:

HIGH & MODERATE: Include in Continuous Monitoring ISSO digest/report to JAB/AO.<./p>

Supplemental Guidance: NONE

RELATED CONTROLS: RA-5 (6)

RA-5 (7) VULNERABILITY SCANNING | AUTOMATED DETECTION AND NOTIFICATION OF UNAUTHORIZED COMPONENTS

[Withdrawn: Incorporated into CM-8].

RA-5 (8) VULNERABILITY SCANNING | REVIEW HISTORIC AUDIT LOGS
  • FedRAMP Baseline Membership RA-5 (8):
  • MODERATE
  • HIGH

The organization reviews historic audit logs to determine if a vulnerability identified in the information system has been previously exploited.

Click Low | Moderate | High below to see FedRAMP control configuration information. It's in BOLD.

There are no FedRAMP-specific requirements if this control is used for a LOW Impact system.

The organization reviews historic audit logs to determine if a vulnerability identified in the information system has been previously exploited.

FedRAMP REQUIREMENT:

HIGH & MODERATE: This enhancement is required for all high vulnerability scan findings.

FedRAMP GUIDANCE:

HIGH & MODERATE: While scanning tools may label findings as high or critical, the intent of the control is based around NIST's definition of high vulnerability.

The organization reviews historic audit logs to determine if a vulnerability identified in the information system has been previously exploited.

FedRAMP REQUIREMENT:

HIGH & MODERATE: This enhancement is required for all high vulnerability scan findings.

FedRAMP GUIDANCE:

HIGH & MODERATE: While scanning tools may label findings as high or critical, the intent of the control is based around NIST's definition of high vulnerability.


Supplemental Guidance: NONE

RELATED CONTROLS: RA-5 (8)

RA-5 (9) VULNERABILITY SCANNING | PENETRATION TESTING AND ANALYSES

[Withdrawn: Incorporated into CA-8].

RA-5 (10) VULNERABILITY SCANNING | CORRELATE SCANNING INFORMATION
  • FedRAMP Baseline Membership RA-5 (10):
  • HIGH

The organization correlates the output from vulnerability scanning tools to determine the presence of multi-vulnerability/multi-hop attack vectors.

Click Low | Moderate | High below to see FedRAMP control configuration information. It's in BOLD.

There are no FedRAMP-specific requirements if this control is used for a LOW Impact system.

There are no FedRAMP-specific requirements if this control is used for a MODERATE Impact system.

FedRAMP GUIDANCE:

HIGH: If multiple tools are not used, this control is not applicable.


Supplemental Guidance: NONE

REFERENCES:

  • NIST Special Publication 800-115
  • NIST Special Publication 800-40
  • NIST Special Publication 800-70
  • http://cwe.mitre.org
  • http://nvd.nist.gov