3.11.2 — Scan for Vulnerabilities

The One-Liner

If you’re not scanning regularly, you’re waiting to be surprised by an attacker who is.

What It Says

Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.

What It Actually Means

Two scanning triggers: periodic (defined schedule — monthly or quarterly is standard) and event-driven (when a new critical vulnerability is disclosed that affects your technology). All CUI systems must be scanned: servers, workstations, network devices, cloud services, and applications — and the targets teams routinely forget, networked printers, scanners, and copiers, which run firmware and sit on the network like any other host. Devices that don’t routinely connect — laptops that travel or stay remote — still have to be scanned; schedule them in rather than letting them slip through the gaps. Scans cover both infrastructure (OS, services, ports) and applications (web apps, custom software). Run them authenticated (credentialed) wherever you can — an unauthenticated scan sees only what’s exposed on the network, while a credentialed scan logs in to enumerate installed software and missing patches that unauthenticated scanning systematically under-reports; expect the assessor to ask which mode your scans run in. Custom-developed software needs more than an automated network scan: scan the source code before deployment and use penetration testing to confirm which findings are real. Verify that the scanner refreshes its vulnerability database at the start of every scan — stale plugins produce stale results, which is exactly what the assessment objectives check. Schedule scans with operational impact in mind, taking extra care around critical or fragile assets. Results are documented, triaged, and fed into remediation (3.11.3).

---

Pass or Fail

Your assessor needs a “yes” to every row:

#	Question	What “yes” looks like
1	Is the scan frequency defined?	Policy specifies scan schedule — monthly is standard
2	Are systems scanned per the schedule?	Scan results showing regular execution across all CUI systems
3	Are applications scanned per the schedule?	Application vulnerability scans or code reviews on defined schedule
4	Are systems scanned when new vulnerabilities emerge?	Ad-hoc scan records triggered by CISA KEV additions or critical CVEs
5	Are applications scanned when new vulnerabilities emerge?	Ad-hoc application scans for newly disclosed vulnerabilities

---

What to Have Ready on Assessment Day

Documents they’ll review: Risk assessment policy; vulnerability scanning procedures and schedule; scan results (recent and historical); scanner configuration; system security plan; ad-hoc scan records triggered by critical CVEs

People they’ll talk to: Personnel with risk assessment and vulnerability management responsibilities; information security personnel

Live demos they’ll ask for: “Show me your most recent vulnerability scan results.” “Are all CUI systems covered — endpoints, servers, network devices, cloud?” “Show me an ad-hoc scan triggered by a critical CVE.”

---

The Assessor’s Playbook

These are the actual questions. Have answers ready.

• “How often do you scan for vulnerabilities? Show me the schedule.”
• “Show me the most recent scan results.”
• “Are all CUI systems covered — including network devices and cloud?”
• “Show me an ad-hoc scan triggered by a new critical vulnerability.”

Real-World Example

A defense contractor runs monthly vulnerability scans using Defender Vulnerability Management across all CUI systems. Scans cover: Windows endpoints, Windows servers, the Palo Alto firewall, and cloud configurations via Defender for Cloud. When a new critical CVE affecting Palo Alto is published, an ad-hoc scan is run within 48 hours to verify exposure. All scan results are triaged by the IT Security Lead within one week, with findings prioritized by severity and fed into remediation tickets. The assessor reviews six months of scan results, confirms monthly execution, and checks for an ad-hoc scan triggered by a recent CISA KEV addition.

---

Where Companies Trip Up

No regular scanning. Only scanning before the annual assessment. Monthly is the standard.

Incomplete coverage. Workstations scanned but not network devices, cloud services, applications, or the networked printers, scanners, and copiers quietly running outdated firmware. Scan everything in your CUI environment.

No ad-hoc scans. A critical CVE is published and you wait for the next monthly scan. Critical disclosures require immediate scanning.

---

How to Talk About This

To a CEO or Board

We scan our entire CUI environment monthly for vulnerabilities and immediately when critical new vulnerabilities are disclosed. All findings are triaged, prioritized, and tracked to remediation.

To an Engineering Team

Monthly Defender Vulnerability Management scans on all CUI systems. Defender for Cloud for cloud configs. Ad-hoc scans within 48 hours for CISA KEV additions. Results triaged weekly. Findings feed remediation tickets.

---

Connected Requirements

Requirement	Why it matters here
3.11.1 — Assess Your Risks	Vulnerability data feeds the risk assessment
3.11.3 — Fix What You Find	Scan results drive remediation
3.14.1 — Patch Your Systems	Patching remediates the vulnerabilities identified by scanning