Skip to content

Vulnerability Scanning

What is Vulnerability Scanning?

Automated testing that identifies known security weaknesses in systems, networks, and applications by comparing them against databases of known vulnerabilities.

Information Security

Terms that appear alongside vulnerability scanning

Each of these is named in at least one of the same controls as vulnerability scanning. The number is how many controls name both.

Frameworks that govern vulnerability scanning

NIST Cybersecurity Framework 2.0View framework →CIS Controls v8View framework →

What the standards actually require on vulnerability scanning

Requirements naming vulnerability scanning across 6 standards, quoted from the control text.

ACSC Essential Eight4 controls

A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities. Required at Maturity Levels One, Two and Three of the Patch applications mitigation strategy (Appendices A, B and C);

acsc-essential-eight::E8-PATCHAPP-ISM-1808 · Patch applications (ISM-1808): A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities →
Australian Information Security Manual3 controls

A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services.

ISM-1698 · Daily vulnerability scanning of online services →
PCI DSS 4.03 controls

Internal vulnerability scans must use authenticated scanning, with these conditions: systems that cannot accept scanning credentials are documented; systems that do accept credentials are scanned with sufficient privileges;

11.3.1.2 · 11.3.1.2 Authenticated internal vulnerability scanning →
FedRAMP Rev 52 controls

Where standard images make asset classes identical, scanning a sample can represent the unique inventory: the provider complies with the scanning requirements, activates and annually tests a method demonstrating that assets in a class are identical, develops a...

fedramp-rev-5::C.5 · C.5 Sampling for vulnerability scanning →
NIST SP 800-1712 controls

Scan for vulnerabilities in systems and applications at a defined cadence and remediate identified vulnerabilities within risk-based timeframes.

171-RA-2 · Vulnerability Scanning and Remediation →
SWIFT CSCF2 controls

Run regular authenticated vulnerability scans of SWIFT systems and feed findings into a tracked remediation process.

CSCF-2.7 · Vulnerability Scanning →

Questions people ask about vulnerability scanning

What is Vulnerability Scanning?
Automated testing that identifies known security weaknesses in systems, networks, and applications by comparing them against databases of known vulnerabilities.
Why is Vulnerability Scanning important for compliance?
Vulnerability Scanning is a key concept in Information Security. Understanding vulnerability scanning helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
Which compliance frameworks address Vulnerability Scanning?
Vulnerability Scanning appears in the requirement text of ACSC Essential Eight, Australian Information Security Manual, PCI DSS 4.0, FedRAMP Rev 5, NIST SP 800-171. Across these standards we have identified 16 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Vulnerability Scanning?
Explore our compliance framework pages to see how vulnerability scanning applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Vulnerability Scanning applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.