CMMC Navigatorby Foxx Cyber Bedrock CMMC

↑↓ to move, Enter to open, Esc to close. Try 3.5.3, AC.L2-3.1.1, MFA or unmarked.

3.11.2Scan for vulnerabilities

Regular vulnerability scanning, plus scans when new vulnerabilities are announced.

The requirement, verbatim

NIST SP 800-171 Rev. 2 · 3.11.2

Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.

Requirement 3.11.2, practice name in the CMMC assessment guide: Vulnerability Scan.

NIST's discussion

Organizations determine the required vulnerability scanning for all system components, ensuring that potential sources of vulnerabilities such as networked printers, scanners, and copiers are not overlooked. The vulnerabilities to be scanned are readily updated as new vulnerabilities are discovered, announced, and scanning methods developed. This process ensures that potential vulnerabilities in the system are identified and addressed as quickly as possible. Vulnerability analyses for custom software applications may require additional approaches such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Organizations can employ these analysis approaches in source code reviews and in a variety of tools (e.g., static analysis tools, web-based application scanners, binary analyzers). Vulnerability scanning includes: scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for improperly configured or incorrectly operating information flow control mechanisms.

To facilitate interoperability, organizations consider using products that are Security Content Automated Protocol (SCAP)-validated, scanning tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention, and that employ the Open Vulnerability Assessment Language (OVAL) to determine the presence of system vulnerabilities. Sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD).

Security assessments, such as red team exercises, provide additional sources of potential vulnerabilities for which to scan. Organizations also consider using scanning tools that express vulnerability impact by the Common Vulnerability Scoring System (CVSS). In certain situations, the nature of the vulnerability scanning may be more intrusive or the system component that is the subject of the scanning may contain highly sensitive information. Privileged access authorization to selected system components facilitates thorough vulnerability scanning and protects the sensitive nature of such scanning.

NIST SP 800-40 provides guidance on vulnerability management.

NIST SP 800-171 Rev. 2, discussion under 3.11.2. Whitespace normalised; wording unchanged.

Assessment objectives

An assessor decides each of these separately. The requirement is met only when every objective is.

  1. [a] the frequency to scan for vulnerabilities in organizational systems and applications is defined
  2. [b] vulnerability scans are performed on organizational systems with the defined frequency
  3. [c] vulnerability scans are performed on applications with the defined frequency
  4. [d] vulnerability scans are performed on organizational systems when new vulnerabilities are identified
  5. [e] vulnerability scans are performed on applications when new vulnerabilities are identified

NIST SP 800-171A, determination statements for 3.11.2.

For assessors: examine, interview, test

NIST SP 800-171A names what an assessor may examine, whom they may interview, and what they may test for this requirement. Assessors select from these lists; they are not a checklist of everything you must produce.

Examine
  • Risk assessment policy
  • procedures addressing vulnerability scanning
  • risk assessment
  • system security plan
  • security assessment report
  • vulnerability scanning tools and associated configuration documentation
  • vulnerability scanning results
  • patch and vulnerability management records
  • other relevant documents or records
Interview
  • Personnel with risk assessment, security assessment and vulnerability scanning responsibilities
  • personnel with vulnerability scan analysis and remediation responsibilities
  • personnel with information security responsibilities
  • system or network administrators
Test
  • Organizational processes for vulnerability scanning, analysis, remediation, and information sharing
  • mechanisms supporting or implementing vulnerability scanning, analysis, remediation, and information sharing

NIST SP 800-171A, potential assessment methods and objects for 3.11.2.

Evidence

No evidence examples are published for this requirement yet. The objectives above are what an assessor checks; evidence is whatever shows each one is true in your environment, dated and kept with your system security plan.

Scoring weight

Worth 5 points. Not meeting this requirement subtracts 5 from your 110-point SPRS score. These are the requirements with the largest effect on your posture.

DoD NIST SP 800-171 Assessment Methodology v1.2.1 weighting, as carried in the Bedrock scoring table. The score starts at 110 and subtracts the weight of every requirement not met.

In Rev. 3

Rev. 2 is what your contract requires today. A standing DoD class deviation keeps Rev. 2 in force; NIST has published Rev. 3, but it is not adopted for contracts. In Rev. 3 this requirement is reworded: 03.11.02 Vulnerability Monitoring and Scanning. It gains organization-defined parameters.

See the Rev. 2 and Rev. 3 wording word by word, or start with the status page.

Where this page's facts come from
Requirement text
bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.basicRequirement@rev2
Discussion
bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.discussion@rev2
Practice name
bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.title@rev2 (CMMC Assessment Guide practice name)
Objectives
bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2
Examine, interview, test
bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2 ({examineGuidance, interviewGuidance, testGuidance})
Level
bedrock-cmmc-api@89b8e8e:migrations/021_fix_level1_requirements.sql#Requirement.cmmcLevel@rev2
Weight
bedrock-cmmc-api@89b8e8e:internal/cmmc/requirement_values.go#requirementValues (DoD AM v1.2.1 / eMASS L2 template v3.8)
Rev. 3 mapping
bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/r2_r3_transition_map.json#r2_to_r3
Plain-language title and summary
editorial/CMMC Navigator.dc.html#RAW (Foxx Cyber editorial)