Access and Use Policy to CITR-022: for control details. Risk Assessment (RA) Security Baselines Control Control Name/Requirement Number Low High Security Categorization Security Categorization Risk Management Framework RA-2 to CITR-019: X X X (RMF) FAQ II and for control details. Risk Assessment Risk Assessment Risk Management Framework RA-3 Refer to CITR-019: X X X (RMF) for control details. Vulnerability Scanning Vulnerability Scanning Transmittal Memo Refer to the DOC memorandum RA-5 X X X for CITR-016 and CITR-17 (Jan. 25th, 2012) for control details. Update Tool Capability Vulnerability Scanning and Patch RA-5.1 Refer to CITR-016: X X Management for control details. Update by Frequency / Prior to New Scan / When Identified RA-5.2 X X Vulnerability Scanning and Patch Refer to CITR-016: Management for control details. Breadth / of Coverage The DOC requires the OUs to employ vulnerability scanning procedures that can demonstrate the breadth RA-5.3 X X X and depth of scan coverage, including vulnerabilities checked and information system components scanned. Privileged Access Vulnerability Scanning and Patch RA-5.5 to CITR-016: X X Management for control details. System and Services Acquisition (SA) Security Baselines Control Control Name/Requirement Number Low High
to CITR-022: Access and Use Policy for control details. Risk Assessment (RA) Control Number Control Name/Requirement Security Baselines Low High Security Categorization RA-2 Security Categorization to CITR-019: Risk Management Framework (RMF) and FAQ II for control details. X X X Risk Assessment RA-3 Risk Assessment Refer to CITR-019: Risk Management Framework (RMF) for control details. X X X Vulnerability Scanning RA-5 Vulnerability Scanning Refer to the DOC memorandum Transmittal Memo for CITR-016 and CITR-17 (Jan. 25th, 2012) for control details. X X X RA-5.1 Update Tool Capability Refer to CITR-016: Vulnerability Scanning and Patch Management for control details. X X RA-5.2 Update by Frequency / Prior to New Scan / When Identified Refer to CITR-016: Vulnerability Scanning and Patch Management for control details. X X RA-5.3 Breadth / of Coverage The DOC requires the OUs to employ vulnerability scanning procedures that can demonstrate the breadth and depth of scan coverage, including vulnerabilities checked and information system components scanned. X X X RA-5.5 Privileged Access to CITR-016: Vulnerability Scanning and Patch Management for control details. X X System and Services Acquisition (SA) Control Number Control Name/Requirement Security Baselines Low High