FedRAMP Rev 5 C.5: C.5 Sampling for vulnerability scanning

Where standard images make asset classes identical, scanning a sample can represent the unique inventory: the provider complies with the scanning requirements, activates and annually tests a method demonstrating that assets in a class are identical, develops a vulnerability sampling plan reviewed at least annually that describes selection, justifies the unique inventory items built from standard images, randomizes selection each month and explains representativeness, establishes the unique inventory and a sample the assessor attests to at the annual assessment with updates when the inventory changes, analyses results for variance within a class and raises unexpected variances with the AO in the next POA&M with a high-risk item to investigate where applicable, justifies its participation, and obtains the assessor's attestation and the approval of every authorizing AO before sampling, which the AO may rescind; 100 percent scanning of externally accessible components is recommended and sampling them needs strong justification.