Operating systems, web applications and databases are scanned monthly (RA-5): the entire inventory or the approved sample at OS level, all web interfaces and services, and all databases including those supporting the infrastructure; each unique vulnerability, by the scanner's unique reference identifier, is tracked as an individual POA&M item, which may be split by asset type but never grouped with other vulnerabilities; all non-destructive detections are enabled; and where the provider offers virtual images that customers scan but the provider patches, the provider scans the source image of every customer-leveraged image in use or available to federal customers.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.