Skip to main content

💼 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded

  • Contextual name: 💼 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded
  • ID: /frameworks/nist-csf-v2.0/id-ra/01
  • Located in: 💼 Risk Assessment (ID.RA)

Description​

  1. Use vulnerability management technologies to identify unpatched and misconfigured software
  2. Assess network and system architectures for design and implementation weaknesses that affect cybersecurity
  3. Review, analyze, or test organization-developed software to identify design, coding, and default configuration vulnerabilities
  4. Assess facilities that house critical computing assets for physical vulnerabilities and resilience issues
  5. Monitor sources of cyber threat intelligence for information on new vulnerabilities in products and services
  6. Review processes and procedures for weaknesses that could be exploited to affect cybersecurity

Similar​

  • Sections
    • /frameworks/nist-csf-v1.1/id-ra/01
    • /frameworks/nist-csf-v1.1/pr-ip/12
    • /frameworks/nist-csf-v1.1/de-cm/08
    • /frameworks/nist-sp-800-53-r5/ca/02
    • /frameworks/nist-sp-800-53-r5/ca/07
    • /frameworks/nist-sp-800-53-r5/ca/08
    • /frameworks/nist-sp-800-53-r5/ra/03
    • /frameworks/nist-sp-800-53-r5/ra/05
    • /frameworks/nist-sp-800-53-r5/sa/11/02
    • /frameworks/nist-sp-800-53-r5/sa/15/07
    • /frameworks/nist-sp-800-53-r5/sa/15/08
    • /frameworks/nist-sp-800-53-r5/si/04
    • /frameworks/nist-sp-800-53-r5/si/05

Similar Sections (Take Policies From)​

SectionSub SectionsInternal RulesPoliciesFlags
💼 NIST CSF v1.1 → 💼 DE.CM-8: Vulnerability scans are performed77
💼 NIST CSF v1.1 → 💼 ID.RA-1: Asset vulnerabilities are identified and documented1415
💼 NIST CSF v1.1 → 💼 PR.IP-12: A vulnerability management plan is developed and implemented78
💼 NIST SP 800-53 Revision 5 → 💼 CA-2 Control Assessments3
💼 NIST SP 800-53 Revision 5 → 💼 CA-7 Continuous Monitoring68
💼 NIST SP 800-53 Revision 5 → 💼 CA-8 Penetration Testing3
💼 NIST SP 800-53 Revision 5 → 💼 RA-3 Risk Assessment4
💼 NIST SP 800-53 Revision 5 → 💼 RA-5 Vulnerability Monitoring and Scanning11
💼 NIST SP 800-53 Revision 5 → 💼 SA-11(2) Developer Testing and Evaluation _ Threat Modeling and Vulnerability Analyses
💼 NIST SP 800-53 Revision 5 → 💼 SA-15(7) Development Process, Standards, and Tools _ Automated Vulnerability Analysis
💼 NIST SP 800-53 Revision 5 → 💼 SA-15(8) Development Process, Standards, and Tools _ Reuse of Threat and Vulnerability Information
💼 NIST SP 800-53 Revision 5 → 💼 SI-4 System Monitoring2526
💼 NIST SP 800-53 Revision 5 → 💼 SI-5 Security Alerts, Advisories, and Directives1

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags

Policies (22)​

PolicyLogic CountFlags
📝 AWS Account Multi-Region CloudTrail is not enabled 🟢1🟢 x6
📝 AWS API Gateway API Access Logging in CloudWatch is not enabled 🟢1🟠 x1, 🟢 x5
📝 AWS API Gateway API Execution Logging in CloudWatch is not enabled 🟢1🟢 x6
📝 AWS API Gateway REST API Stage X-Ray Tracing is not enabled 🟢1🟢 x6
📝 AWS CloudTrail Log File Validation is not enabled 🟢1🟢 x6
📝 AWS CloudTrail S3 Bucket Access Logging is not enabled. 🟢1🟢 x6
📝 AWS EC2 Auto Scaling Group behind ELB doesn't use ELB health check 🟢1🟢 x6
📝 AWS RDS Instance Auto Minor Version Upgrade is not enabled 🟠🟢1🟠 x1, 🟢 x6
📝 AWS S3 Bucket Server Access Logging is not enabled 🟢1🟢 x6
📝 AWS VPC Flow Logs are not enabled 🟢1🟠 x1, 🟢 x5
📝 Azure PostgreSQL Flexible Server connection_throttle.enable Parameter is not set to ON 🟢1🟢 x6
📝 Azure SQL Server Auditing is not enabled 🟢1🟢 x6
📝 Azure SQL Server Auditing Retention is less than 90 days 🟢1🟢 x6
📝 Azure Storage Blob Logging is not enabled for Read, Write, and Delete requests 🟢1🟢 x6
📝 Azure Storage Queue Logging is not enabled for Read, Write, and Delete requests 🟢1🟢 x6
📝 Azure Subscription Microsoft Defender For (Managed Instance) Azure SQL Databases is not set to On 🟢1🟢 x6
📝 Azure Subscription Microsoft Defender For App Services is not set to On 🟢1🟢 x6
📝 Azure Subscription Microsoft Defender For Containers is not set to On 🟢1🟢 x6
📝 Azure Subscription Microsoft Defender For Key Vault is not set to On 🟢1🟢 x6
📝 Azure Subscription Microsoft Defender For Servers is not set to On 🟢1🟢 x6
📝 Azure Subscription Microsoft Defender For SQL Servers On Machines is not set to On 🟢1🟢 x6
📝 Azure Subscription Microsoft Defender For Storage is not set to On 🟢1🟢 x6