Skip to main content
← All controls
RA-5 / A.12.6.1 / CIS-7.3 NIST SP 800-53 Rev 5

How often do you scan internet-facing systems for vulnerabilities?

Demonstrate that the organization performs vulnerability scanning of internet-facing systems at a defined, documented frequency with evidence of consistent execution and remediation workflows.

Description

What this control does

This control establishes the frequency at which automated vulnerability scanning is performed against internet-facing assets such as web applications, mail servers, VPN gateways, and public APIs. Scanning identifies exploitable weaknesses (CVEs, misconfigurations, weak ciphers) before attackers can leverage them. Regular scanning cadence—typically weekly, monthly, or triggered by change events—ensures new exposures from software updates, infrastructure changes, or newly disclosed vulnerabilities are detected promptly.

Control objective

What auditing this proves

Demonstrate that the organization performs vulnerability scanning of internet-facing systems at a defined, documented frequency with evidence of consistent execution and remediation workflows.

Associated risks

Risks this control addresses

  • Unpatched critical vulnerabilities in public-facing systems exploited by automated scanners or threat actors
  • Zero-day exploits or newly disclosed CVEs remaining undetected between infrequent scan cycles
  • Configuration drift on perimeter devices introducing exploitable weaknesses unknown to security teams
  • Compliance violations due to failure to meet mandated scanning frequencies (e.g., PCI DSS quarterly requirements)
  • Delayed incident response when vulnerabilities discovered through breach forensics rather than proactive scanning
  • Public exposure of sensitive data or services through misconfigurations not caught by sporadic assessments
  • Lateral movement opportunities created when internet-facing footholds remain vulnerable for extended periods

Testing procedure

How an auditor verifies this control

  1. Obtain and review the organization's vulnerability management policy and procedures to identify the documented scanning frequency for internet-facing systems.
  2. Request an inventory of all internet-facing IP addresses, domains, and assets currently in scope for vulnerability scanning.
  3. Identify the vulnerability scanning tools in use (e.g., Tenable, Qualys, Rapid7, Nessus) and review configuration settings for scan schedules and coverage.
  4. Collect scan reports, logs, or dashboard exports for the most recent 6-12 month period covering internet-facing assets.
  5. Verify that scans executed according to the stated frequency by comparing scheduled scan dates to actual execution timestamps in logs or job history.
  6. Select a sample of 5-10 internet-facing assets and trace their inclusion in scan reports across multiple scan cycles to confirm continuous coverage.
  7. Interview the vulnerability management lead to understand processes for handling scan failures, asset onboarding, and frequency exceptions.
  8. Review evidence of scan findings being routed to ticketing or GRC systems and confirm that high/critical vulnerabilities trigger defined response workflows.
Evidence required Auditor collects vulnerability management policy excerpts defining scan frequency, asset inventory lists showing internet-facing systems, scanning tool configuration exports or screenshots showing scheduled job cadence, scan completion logs or reports with timestamps for the trailing 12 months, ticketing system records linking high-severity findings to remediation activities, and documented evidence of scan coverage verification processes.
Pass criteria Internet-facing systems are scanned for vulnerabilities at intervals matching or exceeding the documented frequency, with evidence of consistent execution, no gaps exceeding the stated cycle, and formal tracking of findings through closure.