Scan for vulnerabilities….
This the fifth-most “Other than satisfied” #CMMC requirement with an 18% fail rate.
3.11.2 ๐๐๐๐ง ๐๐จ๐ซ ๐ฏ๐ฎ๐ฅ๐ง๐๐ซ๐๐๐ข๐ฅ๐ข๐ญ๐ข๐๐ฌ ๐ข๐ง ๐จ๐ซ๐ ๐๐ง๐ข๐ณ๐๐ญ๐ข๐จ๐ง๐๐ฅ ๐ฌ๐ฒ๐ฌ๐ญ๐๐ฆ๐ฌ ๐๐ง๐ ๐๐ฉ๐ฉ๐ฅ๐ข๐๐๐ญ๐ข๐จ๐ง๐ฌ ๐ฉ๐๐ซ๐ข๐จ๐๐ข๐๐๐ฅ๐ฅ๐ฒ ๐๐ง๐ ๐ฐ๐ก๐๐ง ๐ง๐๐ฐ ๐ฏ๐ฎ๐ฅ๐ง๐๐ซ๐๐๐ข๐ฅ๐ข๐ญ๐ข๐๐ฌ ๐๐๐๐๐๐ญ๐ข๐ง๐ ๐ญ๐ก๐จ๐ฌ๐ ๐ฌ๐ฒ๐ฌ๐ญ๐๐ฆ๐ฌ ๐๐ง๐ ๐๐ฉ๐ฉ๐ฅ๐ข๐๐๐ญ๐ข๐จ๐ง๐ฌ ๐๐ซ๐ ๐ข๐๐๐ง๐ญ๐ข๐๐ข๐๐.
“๐๐๐๐๐๐๐๐๐๐๐๐๐๐ ๐๐๐๐๐๐๐”…
This is an example of a broadly-applicable requirement – something that is expected to be applied ๐ฉ๐ฐ๐ญ๐ช๐ด๐ต๐ช๐ค๐ข๐ญ๐ญ๐บ from boundary to boundary, not just to assets that have CUI.
Many assessors will expect you to perform vulnerability scans of the entire network where you have CUI, not just the “CUI Assets”. This means that your CRMA ๐ป are fair game for vulnerability scans if they can affect the security of your CUI. (I’ll ask in poll)
If you only scan convenient systems, such as the ones at the office, while ignoring the laptops on the road, you will probably fail.
“๐๐๐๐๐๐๐๐๐๐๐๐”…
To me, the primary use case for “applications” is software that can be connected to via a listening network port. I’m thinking of web servers, database servers, file servers. These are high-risk for compromise due to vulnerabilities because they can be attacked from the network.
I’m guessing that applications are called out separately from systems because scanning network-enabled applications for vulnerabilities is a different process than enumerating software versions in a system.
For example, scanning a Linux operating system may not detect flaws in the WordPress website hosted by the server. Thus both are required separately because NIST doesn’t want anyone to forget to scan the website or database.
Most simple software like Microsoft Office, Chrome, and Adobe Acrobat would be vulnerability scanned as part of the organizational system it is installed on.
“๐๐๐๐๐๐
๐๐๐๐๐๐”…
This just means “at least once per year”.
“๐๐๐๐ ๐๐๐ ๐๐๐๐๐๐๐๐๐๐๐๐๐๐๐ ๐๐๐ ๐๐
๐๐๐๐๐๐๐๐
”…
This is a pain point which probably causes the most failures. You need to be able to demonstrate running a vulnerability scan against your environment in response to a newly discovered vulnerability.
For example, anyone remember Log4Shell, affecting Apache log library Log4j, which is used by a ton of different applications?
If your network existed in 2021, an assessor might ask you for the vulnerability scan you performed in response to Log4Shell. ๐ฑ
You didn’t run one? Doom!
โฐ Perform continuous vulnerability scans? If you are automatically performing vulnerability scans within a day or two of each vulnerability detection, it is my opinion that you are exceeding the expectation for this requirement.