How often do you scan internal systems for vulnerabilities (authenticated where possible)?
Demonstrate that the organization performs vulnerability scans of internal systems at defined, appropriate intervals using authenticated methods where technically feasible, and that scan coverage encompasses all critical and in-scope assets.
Description
What this control does
This control establishes the cadence and methodology for conducting vulnerability scans against internal infrastructure, endpoints, databases, and applications. Authenticated scanning uses credentials to probe deeper into system configurations, installed software, and patch levels—providing more accurate identification of exploitable weaknesses than unauthenticated scans. Regular scanning frequency (e.g., weekly, monthly) ensures newly disclosed vulnerabilities are detected before adversaries exploit them, and scanning scope must cover all on-premises and cloud-hosted assets.
Control objective
What auditing this proves
Demonstrate that the organization performs vulnerability scans of internal systems at defined, appropriate intervals using authenticated methods where technically feasible, and that scan coverage encompasses all critical and in-scope assets.
Associated risks
Risks this control addresses
- Exploitation of unpatched vulnerabilities due to infrequent or absent scanning, allowing lateral movement within the network
- Credential-based attacks succeeding because weak or default passwords remain undetected without authenticated scan depth
- Compliance violations and audit findings resulting from failure to meet regulatory scanning frequency requirements
- Zero-day or newly disclosed vulnerabilities remaining unidentified for extended periods due to insufficient scan cadence
- False sense of security from unauthenticated scans that miss kernel-level or application-layer flaws requiring privileged access
- Data breach or ransomware incident originating from internal systems with exploitable CVEs that scanning would have flagged
- Shadow IT or unmanaged devices operating without vulnerability visibility, creating unmonitored attack surface
Testing procedure
How an auditor verifies this control
- Obtain and review the organization's vulnerability management policy, including documented scan frequency requirements and authentication standards.
- Request a complete inventory of scanning tools deployed (e.g., Tenable, Qualys, Rapid7) and confirm licensure and operational status.
- Review scan schedules and automation configurations within the vulnerability management platform to verify programmed cadence matches policy.
- Pull scan history logs or dashboards for the prior 90 days and verify actual execution frequency for all asset groups (servers, workstations, databases, cloud instances).
- Select a representative sample of 10-15 internal assets across different segments and validate that authenticated scans were performed using service accounts or credential vaults.
- Examine authentication success rates within scan reports to confirm credentials are valid and scans achieve privileged access to target systems.
- Cross-reference asset inventory against scan targets to identify any systems excluded from scanning or missing from scope definitions.
- Interview IT operations or security engineering staff to confirm remediation workflows triggered by scan findings and validate that scan frequency accommodates remediation SLAs.