Vulnerability Monitoring and Scanning RA-5
Risk Assessment · Low baseline ✗ Not implemented
Status — program-wide
What references this control
No risks name this control in their Framework field yet.
No policies reference it yet.
Link a risk or policy to this control
Attaching adds RA-5 to the item's Framework field; the ✨ AI button suggests the best match. You can also edit the Framework field on a risk / policy directly.
Source: NIST SP 800-53 Rev.5, Risk Assessment family NIST SP 800-53 Rev.5. The baseline shows the lowest SP 800-53B baseline (Low / Moderate / High) this control appears in NIST SP 800-53B.
Control guide — plain-English, per NIST SP 800-53
RA-5 (Vulnerability Monitoring and Scanning) requires you to scan the system for known weaknesses on a defined schedule and when new flaws are announced, analyze the results, and remediate or track what you find. CVE (Common Vulnerabilities and Exposures) findings feed the risk picture. It carries into the Moderate baseline.
What good looks like
- Scan for vulnerabilities on a regular schedule and whenever new flaws are reported.
- Use tools that check the operating system, applications, and configuration for known weaknesses.
- Analyze the output, clear false positives, and rank real findings by severity.
- Remediate legitimate findings within a defined time, or track them formally when a fix is deferred.
- At Moderate, run authenticated (credentialed) scans so the tool sees the host the way an insider would (enhancement RA-5(5)).
Framework mapping
- NIST CSF 2.0 — ID.RA-01 — Vulnerabilities in assets are identified, validated, and recorded
- CIS Controls v8 — Control 7 — Continuous Vulnerability Management
How to move it toward Implemented
- The host is already scanned:
lynis audit systemchecks configuration weaknesses and produced a hardening index of 68 with five items remediated, and Step 0 plus unattended-upgrades patch what it flags — but the scan is a one-off. - Put the Lynis audit on a cadence — run it from a
systemdtimer orcron(for example, weekly) and save each dated report to/var/logas evidence. - Add an authenticated CVE scanner such as OpenVAS/Greenbone or Nessus that checks installed packages against known CVEs, since Lynis only inspects configuration, not the package-level vulnerability list.
- Write a short procedure naming the scan frequency, who reviews results, and the remediation timeline, then attach the dated reports as evidence naming RA-5 to move it from 'Partial' toward 'Completed'.