SA-15(7): Automated Vulnerability Analysis

CSF v1.1 References:

Baselines:

(Not part of any baseline)

Previous Version:

Control Statement

Require the developer of the system, system component, or system service [Assignment: organization-defined frequency] to:

  1. Perform an automated vulnerability analysis using [Assignment: organization-defined tools];
  2. Determine the exploitation potential for discovered vulnerabilities;
  3. Determine potential risk mitigations for delivered vulnerabilities; and
  4. Deliver the outputs of the tools and results of the analysis to [Assignment: organization-defined personnel or roles].

Supplemental Guidance

Automated tools can be more effective at analyzing exploitable weaknesses or deficiencies in large and complex systems, prioritizing vulnerabilities by severity, and providing recommendations for risk mitigations.