[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-800-53\u002Fra-5":3},{"item":4,"lessons":18,"controls":68,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"nist-800-53","ra-5","RA-5","Vulnerability Monitoring and Scanning",824,"US National Institute of Standards and Technology (NIST)","**What it asks for.** The organisation must scan systems and hosted applications for vulnerabilities on a defined schedule and when new vulnerabilities are reported, use tools that support standard formats, analyse the results, fix legitimate findings within defined response times and share what it learns.\n\n**In practice.** This means authenticated scanning of infrastructure, container images and web applications, with results feeding a ticketing process prioritised by severity, exploitability and asset criticality. Auditors want to see scan schedules, coverage against the inventory, trend reports and evidence that findings are closed or formally accepted. CIS Control 7 and ISO\u002FIEC 27001 technical vulnerability management carry the same idea.\n\n**Common gaps.** Common shortfalls are unauthenticated scans that miss most issues, scanning only part of the estate, and large backlogs of known findings with no owner. Cloud assets that appear and disappear between scans are often never assessed.","a. Monitor and scan for vulnerabilities in the system and hosted applications [Assignment: organization-defined organization-defined frequency and\u002For randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported;\n  b. Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:\n    1. Enumerating platforms, software flaws, and improper configurations;\n    2. Formatting checklists and test procedures; and\n    3. Measuring vulnerability impact;\n  c. Analyze vulnerability scan reports and results from vulnerability monitoring;\n  d. Remediate legitimate vulnerabilities [Assignment: organization-defined response times] in accordance with an organizational assessment of risk;\n  e. Share information obtained from the vulnerability monitoring process and control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other systems; and\n  f. Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.\nDiscussion: Security categorization of information and systems guides the frequency and comprehensiveness of vulnerability monitoring (including scans). Organizations determine the required vulnerability monitoring for system components, ensuring that the potential sources of vulnerabilities—such as infrastructure components (e.g., switches, routers, guards, sensors), networked printers, scanners, and copiers—are not overlooked. The capability to readily update vulnerability monitoring tools as new vulnerabilities are discovered and announced and as new scanning methods are developed helps to ensure that new vulnerabilities are not missed by employed vulnerability monitoring tools. The vulnerability monitoring tool update process helps to ensure that potential vulnerabilities in the system are identified and addressed as quickly as possible. Vulnerability monitoring and analyses for custom software may require additional approaches, such as static analysis, dynamic analysis, binary analysis, or a hybrid of the three approaches. Organizations can use these analysis approaches in source code reviews and in a variety of tools, including web-based application scanners, static analysis tools, and binary analyzers.\n\nVulnerability monitoring includes scanning for patch levels; scanning for functions, ports, protocols, and services that should not be accessible to users or devices; and scanning for flow control mechanisms that are improperly configured or operating incorrectly. Vulnerability monitoring may also include continuous vulnerability monitoring tools that use instrumentation to continuously analyze components. Instrumentation-based tools may improve accuracy and may be run throughout an organization without scanning. Vulnerability monitoring tools that facilitate interoperability include tools that are Security Content Automated Protocol (SCAP)-validated. Thus, organizations consider using scanning tools that express vulnerabilities in the Common Vulnerabilities and Exposures (CVE) naming convention and that employ the Open Vulnerability Assessment Language (OVAL) to determine the presence of vulnerabilities. Sources for vulnerability information include the Common Weakness Enumeration (CWE) listing and the National Vulnerability Database (NVD). Control assessments, such as red team exercises, provide additional sources of potential vulnerabilities for which to scan. Organizations also consider using scanning tools that express vulnerability impact by the Common Vulnerability Scoring System (CVSS).\n\nVulnerability monitoring includes a channel and process for receiving reports of security vulnerabilities from the public at-large. Vulnerability disclosure programs can be as simple as publishing a monitored email address or web form that can receive reports, including notification authorizing good-faith research and disclosure of security vulnerabilities. Organizations generally expect that such research is happening with or without their authorization and can use public vulnerability disclosure channels to increase the likelihood that discovered vulnerabilities are reported directly to the organization for remediation.\n\nOrganizations may also employ the use of financial incentives (also known as \"bug bounties\" ) to further encourage external security researchers to report discovered vulnerabilities. Bug bounty programs can be tailored to the organization’s needs. Bounties can be operated indefinitely or over a defined period of time and can be offered to the general public or to a curated group. Organizations may run public and private bounties simultaneously and could choose to offer partially credentialed access to certain participants in order to evaluate security vulnerabilities from privileged vantage points.","From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F53\u002Fr5\u002Fupd1\u002Ffinal","Open SP 800-53 at NIST",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"critical-drupal-rce-flaws-demand-immediate-patching","Critical Drupal RCE Flaws Demand Immediate Patching","2026-10-17T16:20:34.593+00:00",{"slug":25,"title":26,"published_at":27},"ad-network-used-as-zero-click-spyware-delivery-channel-via-real-time-bidding","Ad Network Used as Zero-Click Spyware Delivery Channel via Real-Time Bidding","2026-10-17T12:20:32.316+00:00",{"slug":29,"title":30,"published_at":31},"critical-beyondtrust-auth-bypass-actively-exploited-patch-immediately","Critical BeyondTrust Auth Bypass Actively Exploited — Patch Immediately","2026-10-16T22:21:05.267+00:00",{"slug":33,"title":34,"published_at":35},"critical-magento-rce-flaw-demands-immediate-patching","Critical Magento RCE Flaw Demands Immediate Patching","2026-10-16T22:20:34.131+00:00",{"slug":37,"title":38,"published_at":39},"beyondtrust-zero-day-highlights-critical-risk-of-unpatched-edge-devices","BeyondTrust Zero-Day Highlights Critical Risk of Unpatched Edge Devices","2026-10-16T22:20:18.59+00:00",{"slug":41,"title":42,"published_at":43},"active-exploitation-of-fortinet-and-beyondtrust-flaws-highlights-patch-urgency","Active Exploitation of Fortinet and BeyondTrust Flaws Highlights Patch Urgency","2026-10-16T20:21:00.599+00:00",{"slug":45,"title":46,"published_at":47},"chinese-espionage-group-exploits-beyondtrust-zero-day-in-remote-support-tool","Chinese Espionage Group Exploits BeyondTrust Zero-Day in Remote Support Tool","2026-10-16T18:20:52.789+00:00",{"slug":49,"title":50,"published_at":51},"zero-click-ad-spyware-bypasses-user-interaction-to-compromise-devices","Zero-Click Ad Spyware Bypasses User Interaction to Compromise Devices","2026-10-16T18:20:36.559+00:00",{"slug":53,"title":54,"published_at":55},"vodafone-spain-fined-400k-after-ignoring-known-vulnerability-for-months","Vodafone Spain Fined €400K After Ignoring Known Vulnerability for Months","2026-10-16T12:20:31.802+00:00",{"slug":57,"title":58,"published_at":59},"critical-rce-flaws-in-f5-nginx-and-juniper-junos-os-demand-immediate-patching","Critical RCE Flaws in F5 NGINX and Juniper Junos OS Demand Immediate Patching","2026-10-16T10:20:14.366+00:00",{"slug":61,"title":62,"published_at":63},"beyondtrust-zero-day-exploited-for-months-before-patch","BeyondTrust Zero-Day Exploited for Months Before Patch","2026-10-16T08:21:15.847+00:00",{"slug":65,"title":66,"published_at":67},"china-linked-hackers-exploit-beyondtrust-zero-day-to-seize-remote-support-servers","China-Linked Hackers Exploit BeyondTrust Zero-Day to Seize Remote Support Servers","2026-10-16T08:20:44.884+00:00",[69,74,79,84,89,94],{"slug":70,"name":71,"problem":72,"stories":73},"patch-management","Automated patch management","Known holes get closed in days, not months.",627,{"slug":75,"name":76,"problem":77,"stories":78},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",606,{"slug":80,"name":81,"problem":82,"stories":83},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",236,{"slug":85,"name":86,"problem":87,"stories":88},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",149,{"slug":90,"name":91,"problem":92,"stories":93},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",56,{"slug":95,"name":96,"problem":97,"stories":98},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",46,[100,106,111,116,121,127,133,138],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","7","Control 7","Continuous Vulnerability Management",786,{"family":5,"item":107,"code":108,"title":109,"together":110},"si-2","SI-2","Flaw Remediation",640,{"family":112,"item":113,"code":114,"title":114,"together":115},"itil","overview","ITIL",567,{"family":101,"item":117,"code":118,"title":119,"together":120},"12","Control 12","Network Infrastructure Management",423,{"family":122,"item":123,"code":124,"title":125,"together":126},"nist-sp","800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",422,{"family":128,"item":129,"code":130,"title":131,"together":132},"gdpr","32","Article 32","Security of processing",309,{"family":101,"item":134,"code":135,"title":136,"together":137},"2","Control 2","Inventory and Control of Software Assets",258,{"family":101,"item":139,"code":140,"title":141,"together":142},"13","Control 13","Network Monitoring and Defense",191]