RA-5 ID.RA-1 Vulnerability For all systems hosted in GSA Facilities, OCISO will conduct vulnerability Oversight Semiannually PR.IP-12 Scanning scans IAW GSA IT Security Procedural Guide CIO-IT Security-17-80, using DE.CM-8 Management Process.” Automated “Vulnerability DE.DP-4 Tools DE.DP-5 No deliverable needs to be provided by internally hosted systems. However, RS.CO-3 the ISSO for the information system needs to ensure that all of their assets RS.MI-3 have the agent installed (for agent-based tool) and/or all assets are being scanned for vulnerabilities using the enterprise scan tool. RA-5 (1) DE.CM-8 Vulnerability For systems scanned by GSA OCISO, the Security Operations Division (ISO) OCISO Semiannually DE.DP-5 Scanning | will update scanning tools. Oversight Update Tool using Capability For systems not scanned by ISO, scanning tool updates must be performed Automated prior to scans. Tools SI-2 ID.RA-1 Flaw SSOs must use an automated tool for flaw remediation and OCISO Semiannually PR.IP-12 Remediation management. Oversight using Please refer to the for enterprise tool(s) used for flaw remediation and Automated patch management. Tools SI-2(2) ID.RA-1 Flaw SSOs must use an automated tool to determine the status of systems Oversight Semiannually Remediation | regarding flaw remediation and patches. using Automated Automated Flaw Please refer to the for enterprise tool(s) used for flaw remediation and Tools Remediation patch management. Status
RA-5 ID.RA-1 PR.IP-12 DE.CM-8 DE.DP-4 DE.DP-5 RS.CO-3 RS.MI-3 Vulnerability Scanning For all systems hosted in GSA Facilities, OCISO will conduct vulnerability scans IAW GSA IT Security Procedural Guide CIO-IT Security-17-80, “Vulnerability Management Process.” No deliverable needs to be provided by internally hosted systems. However, the ISSO for the information system needs to ensure that all of their assets have the agent installed (for agent-based tool) and/or all assets are being scanned for vulnerabilities using the enterprise scan tool. Oversight using Automated Tools Semiannually RA-5 (1) DE.CM-8 DE.DP-5 Vulnerability Scanning | Update Tool Capability For systems scanned by GSA OCISO, the Security Operations Division (ISO) will update scanning tools. For systems not scanned by ISO, scanning tool updates must be performed prior to scans. OCISO Oversight using Automated Tools Semiannually SI-2 ID.RA-1 PR.IP-12 Flaw Remediation SSOs must use an automated tool for flaw remediation and management. Please refer to the for enterprise tool(s) used for flaw remediation and patch management. OCISO Oversight using Automated Tools Semiannually SI-2(2) ID.RA-1 Flaw Remediation | Automated Flaw Remediation Status SSOs must use an automated tool to determine the status of systems regarding flaw remediation and patches. Please refer to the for enterprise tool(s) used for flaw remediation and patch management. Oversight using Automated Tools Semiannually
Information_Security_Continuous_Monitoring_Strategy_%5BCIO_IT_12-66_Rev_2%5D_10-10-2017.docx