N
|
controlRA-5

Vulnerability Monitoring and Scanning (RA-5)

Monitor and scan for vulnerabilities in the system and hosted applications [organization-defined] and when new vulnerabilities potentially affecting the system are identified and reported; Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: Analyze vulnerability scan reports and results from vulnerability monitoring; Remediate legitimate vulnerabilities [organization-d

Security Baselines

LOWMODERATEHIGH
risk-assessmentvulnerabilitythreat

Why These Connect

Maps To13

These are equivalent or closely aligned requirements in other frameworks.

Baselined In3

This control is included in the linked security baseline (LOW, MODERATE, or HIGH).

Supports42

These related controls work together — a change to one may affect the others.

Enhances11

These enhancements add specific capabilities or refinements to the base control.

Related Controls(26)

AU-6Audit Record Review, Analysis, and Reporting (AU-6)
LMH
AU-11Audit Record Retention (AU-11)
LMH
AU-13Monitoring for Information Disclosure (AU-13)CA-2Control Assessments (CA-2)
LMH
CA-7Continuous Monitoring (CA-7)
LMH
CA-8Penetration Testing (CA-8)
H
CM-4Impact Analyses (CM-4)
LMH
CM-6Configuration Settings (CM-6)
LMH
CM-7Least Functionality (CM-7)
LMH
PM-31Continuous Monitoring Strategy (PM-31)RA-2Security Categorization (RA-2)
LMH
RA-3Risk Assessment (RA-3)
LMH
CM-2Baseline Configuration (CM-2)
LMH
CM-8System Component Inventory (CM-8)
LMH
SA-11Developer Testing and Evaluation (SA-11)
MH
SA-15Development Process, Standards, and Tools (SA-15)
MH
SC-38Operations Security (SC-38)SI-2Flaw Remediation (SI-2)
LMH
SI-3Malicious Code Protection (SI-3)
LMH
SI-4System Monitoring (SI-4)
LMH
SI-7Software, Firmware, and Information Integrity (SI-7)
MH
SR-11Component Authenticity (SR-11)
LMH
RA-10Threat Hunting (RA-10)SA-24Design For Cyber Resiliency (SA-24)SC-26Decoys (SC-26)SI-5Security Alerts, Advisories, and Directives (SI-5)
LMH

Cross-Framework Mappings(13)

GV.SC-10GV.SC-10Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.RA-01ID.RA-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.RA-08ID.RA-08Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.IM-01ID.IM-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.IM-02ID.IM-02Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.IM-03ID.IM-03Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ISO 27001ISO/IEC 27001:20221 mappingFinal
NIST OLIR informative reference — SP 800-53 Rev 5 to ISO/IEC 27001:2022
GV.SC-10GV.SC-10Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.RA-01ID.RA-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.RA-08ID.RA-08Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.IM-01ID.IM-01Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.IM-02ID.IM-02Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5
ID.IM-03ID.IM-03Final
NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

Organization-Defined Parameters(4)

Assignmentorganization-defined frequency and/or randomly in accordance with organization-defined process
Assignmentorganization-defined frequency and/or randomly in accordance with organization-defined process
Assignmentorganization-defined response times
Assignmentorganization-defined personnel or roles

Control Enhancements(11)

RA-5(1)Update Tool Capability (RA-5(1))W
RA-5(2)Update Vulnerabilities to Be Scanned (RA-5(2))
LMH
RA-5(3)Breadth and Depth of Coverage (RA-5(3))
RA-5(4)Discoverable Information (RA-5(4))
H
RA-5(5)Privileged Access (RA-5(5))
MH
RA-5(6)Automated Trend Analyses (RA-5(6))
RA-5(7)Automated Detection and Notification of Unauthorized Components (RA-5(7))W
RA-5(8)Review Historic Audit Logs (RA-5(8))
RA-5(9)Penetration Testing and Analyses (RA-5(9))W
RA-5(10)Correlate Scanning Information (RA-5(10))
RA-5(11)Public Disclosure Program (RA-5(11))
LMH

See Also

@SP 800-53 Overview⚖Compare Baselines