ID.RA-01.147
Does your organization implement vulnerability management tools to detect unpatched software and misconfigurations?
Explanation
Vulnerability management tools automatically scan systems to identify outdated software, missing security patches, and configuration errors that could be exploited by attackers. These tools help prioritize remediation efforts by categorizing vulnerabilities based on severity and potential impact to your environment. Evidence could include screenshots of vulnerability scanning dashboards showing recent scans, vulnerability management reports highlighting identified issues and remediation status, or documentation of the vulnerability management process including scan frequency and remediation timelines.
Implementation Example
Use vulnerability management technologies to identify unpatched and misconfigured software
ID: ID.RA-01.147
Context
- Function
- ID: IDENTIFY
- Category
- ID.RA: Risk Assessment
- Sub-Category
- Vulnerabilities in assets are identified, validated, and recorded

