VM-01—Vulnerability Scans
>Control Description
Organization conducts vulnerability scans against the production environment; scan tools are updated prior to running scans.
Theme
Process
Type
Detective
Policy/Standard
Vulnerability Management Policy>Implementation Guidance
1. Ensure that the requirements for periodic vulnerability scans are defined and documented. 2. Ensure a process is established for updating the scanning tool version prior to running the scan.
>Testing Procedure
1. Review Vulnerability Management policy and/or standard to validate that they define requirements for periodic vulnerability scans. 2. Inspect scanning tool version information to ensure they are up to date. 3. Validate evidence for a sample of service production hosts/accounts to ensure that vulnerability scans are conducted and tickets are created as appropriate.
>Audit Artifacts
E-VM-01
E-VM-02
E-VM-03
>Framework Mappings
Cross-framework mappings provided by Adobe CCF Open Source under Creative Commons License.
Ask AI
Configure your API key to use AI features.