NIST 800-171 3.11.2 (RA.L2-3.11.2): Vulnerability Scanning

What 3.11.2 means in practice

Scan systems and applications for vulnerabilities on a schedule and whenever a relevant new vulnerability is announced. The scans cover everything inside the boundary, including network devices, printers and cloud resources, and use current vulnerability definitions.

SPRS points and the CMMC POA&M

What an assessor checks for 3.11.2

NIST SP 800-171A gives 5 determination statements for 3.11.2, each found satisfied or other than satisfied. Determine if:

1. 3.11.2[a] the frequency to scan for vulnerabilities in organizational systems and applications is defined.
2. 3.11.2[b] vulnerability scans are performed on organizational systems with the defined frequency.
3. 3.11.2[c] vulnerability scans are performed on applications with the defined frequency.
4. 3.11.2[d] vulnerability scans are performed on organizational systems when new vulnerabilities are identified.
5. 3.11.2[e] vulnerability scans are performed on applications when new vulnerabilities are identified.

NIST SP 800-171A (June 2018), assessment objectives for 3.11.2

Evidence that shows 3.11.2 is met

• The defined scanning frequency.
• Scan reports covering systems and applications over a recent period.
• A scan run after a significant new vulnerability was announced.

How PolicyCortex gathers the evidence

PolicyCortex reads this evidence with the collectors below, read only, and grades 3.11.2 from it. Each line says what the product checks.

• Microsoft Defender for Cloud: Recommendations and assessments. Reads Microsoft Defender for Cloud assessments and checks that vulnerability scanning is on and that its findings are tracked by severity.