RA-5 Vulnerability Scanning
Last Review: 10/1/22
Statement
The University shall implement vulnerability scanning tools in a manner to identify vulnerabilities and provide reporting capabilities to help with remediation efforts.
Applicability
This Control applies to all West Texas A&M network information resources. The intended audience for this Control includes all information resource owners, custodians, and users of information resources.
Implementation
- WTAMU periodically scans for vulnerabilities in applications, computer systems and information systems.
- Vulnerability scans shall employ tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for:
- Enumerating platforms, software flaws, and improper configurations.
- Formatting checklists and test procedures
- Measuring vulnerability impact
- Analysis of vulnerability scan reports and results shall be complied
- Legitimate vulnerabilities are remediated in accordance with organizational assessment of risk.
- Share information obtained from vulnerability monitoring process and security control assessments with system owners and custodians to help eliminate similar vulnerabilities in other systems.
- Vulnerability scans shall employ tools and techniques that include the capability to readily update the vulnerabilities to be scanned.