ra-5-2-update-vulnerabilities-to-be-scanned

name	RA-5(2)_update-vulnerabilities-to-be-scanned
description	Update the system vulnerabilities to be scanned [organization-defined].
category	information-gathering
version	5.2.0
author	cyberstrike-official
tags	["nist","sp800-53","rev5","ra-5-2","ra","enhancement"]
tech_stack	["any"]
cwe_ids	[]
chains_with	["SI-5"]
prerequisites	["RA-5"]
severity_boost	{"SI-5":"Chain with SI-5 for comprehensive security coverage"}

RA-5(2) Update Vulnerabilities to Be Scanned

Enhancement of: RA-5

High-Level Description

Family: Risk Assessment (RA) Framework: NIST SP 800-53 Rev 5

Due to the complexity of modern software, systems, and other factors, new vulnerabilities are discovered on a regular basis. It is important that newly discovered vulnerabilities are added to the list of vulnerabilities to be scanned to ensure that the organization can take steps to mitigate those vulnerabilities in a timely manner.

What to Check

• Verify RA-5(2) Update Vulnerabilities to Be Scanned is documented in SSP
• Confirm control is operating effectively
• Review evidence of continuous monitoring for RA-5(2)
• Verify enhancement builds upon base control RA-5

How to Test

Step 1: Review Documentation

Examine the System Security Plan (SSP) and related artifacts for RA-5(2) implementation details. Verify the organization has documented how this control is satisfied.

Step 2: Validate Implementation

# For cloud environments, use cloud-audit-mcp tools
# For on-premises, review system configurations directly

# Example: Check if account management policies exist
grep -r "account.management\|access.control" /etc/security/ 2>/dev/null

Step 3: Test Operating Effectiveness

Verify the control is actively functioning, not just documented. Check logs, configurations, and operational evidence.

Tools

Tool	Purpose	Usage
Manual Review	Documentation and interview-based	N/A

Remediation Guide

Control Statement

Update the system vulnerabilities to be scanned [organization-defined].

Implementation Guidance

Due to the complexity of modern software, systems, and other factors, new vulnerabilities are discovered on a regular basis. It is important that newly discovered vulnerabilities are added to the list of vulnerabilities to be scanned to ensure that the organization can take steps to mitigate those vulnerabilities in a timely manner.

Risk Assessment

Finding