RA-5(6)—Automated Trend Analyses
>Control Description
Compare the results of multiple vulnerability scans using ⚙organization-defined automated mechanisms.
>Cross-Framework Mappings
>Supplemental Guidance
Using automated mechanisms to analyze multiple vulnerability scans over time can help determine trends in system vulnerabilities and identify patterns of attack.
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What is your organization's documented risk assessment policy and how does it address the requirements of RA-5(6)?
- •Who has been designated as responsible for conducting and maintaining risk assessments?
- •How frequently are risk assessments conducted and what triggers an update to the risk assessment?
Technical Implementation:
- •What methodology or framework do you use to conduct risk assessments?
- •How do you identify and categorize threats and vulnerabilities during the risk assessment process?
- •What tools or systems support your risk assessment activities?
- •What vulnerability scanning tools are used and how often are scans performed?
Evidence & Documentation:
- •Can you provide the most recent risk assessment report?
- •What evidence demonstrates that risk assessment findings are communicated to appropriate stakeholders?
- •Where are risk assessment results documented and how long are they retained?
- •Can you provide recent vulnerability scan reports and evidence of remediation?
Ask AI
Configure your API key to use AI features.