+RA-05(03) Breadth and Depth of Coverage

RA-05(03) Breadth and Depth of Coverage

Control

Define the breadth and depth of vulnerability scanning coverage.

Discussion

The breadth of vulnerability scanning coverage can be expressed as a percentage of components within the system, by the particular types of systems, by the criticality of systems, or by the number of vulnerabilities to be checked. Conversely, the depth of vulnerability scanning coverage can be expressed as the level of the system design that the organization intends to monitor (e.g., component, module, subsystem, element). Organizations can determine the sufficiency of vulnerability scanning coverage with regard to its risk tolerance and other factors. Scanning tools and how the tools are configured may affect the depth and coverage. Multiple scanning tools may be needed to achieve the desired depth and coverage. [SP 800-53A](#a21aef46-7330-48a0-b2e1-c5bb8b2dd11d) provides additional information on the breadth and depth of coverage.

Assessment Objective

the breadth and depth of vulnerability scanning coverage are defined.

Assessment Method

Examine

Procedures addressing vulnerability scanning assessment report vulnerability scanning tools and associated configuration documentation vulnerability scanning results patch and vulnerability management records system security plan other relevant documents or records

Interview

Organizational personnel with vulnerability scanning responsibilities organizational personnel with vulnerability scan analysis responsibilities organizational personnel with security responsibilities

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
is blocked by RA-05(03) Breadth and Depth of Coverage – Assessment Procedure
is blocked by Breadth / Depth of Coverage For Vulnerability Scanning