FedRAMP Rev 5 C.2: C.2 Vulnerability scanning requirements

Scanners are hardened; for Moderate and High systems scans are authenticated wherever possible and run with full system authorization avoiding registry and file access limitations (RA-5(5)); findings of Low and above are output in the richest available machine-readable format including the authentication status of each host, with the CVE reference for any NVD-listed vulnerability and the CVSSv3 base score, or CVSSv2 or the scanner score where none exists, as the original risk rating; the provider gives machine-readable evidence that scanner configuration matches the assessor-validated settings and the AO approves any configuration change beyond normal updates; the vulnerability list is updated to the latest before each deliverable with a scanner that checks for signature updates at least monthly and automated evidence of the last update (RA-5(2)); findings carry unique asset identifiers mapped to the inventory, all assets in the boundary are automatically identified and catalogued monthly, web services are catalogued with their ports, ephemeral assets are uniquely tagged, and every container image class has an asset identifier with production containers tracked automatically and validated under CM-8.