Frameworks / NIST SP 800-53 Rev 5 / NIST800-RA-5 NIST SP 800-53 Rev 5
RA - Risk Assessment
NIST SP 800-53 Rev 5 NIST800-RA-5: RA-5 Vulnerability Monitoring and Scanning a. Monitor and scan for vulnerabilities in the system and hosted applications [Assignment: organization-defined frequency and/or randomly in accordance with organization-defined process] and when new vulnerabilities potentially affecting the system are identified and reported; b. Employ vulnerability monitoring tools and techniques that facilitate interoperability among tools and automate parts of the vulnerability management process by using standards for: 1. Enumerating platforms, software flaws, and improper configurations; 2. Formatting checklists and test procedures; and 3. Measuring vulnerability impact; c. Analyze vulnerability scan reports and results from vulnerability monitoring; d. Remediate legitimate vulnerabilities [Assignment: organization-defined response times] in accordance with an organizational assessment of risk; e. Share information obtained from the vulnerability monitoring process and control assessments with [Assignment: organization-defined personnel or roles] to help eliminate similar vulnerabilities in other systems; and f. Employ vulnerability monitoring tools that include the capability to readily update the vulnerabilities to be scanned.
Maintained by Gerard Blokdyk · Verified against the published standard 31 May 2026 · Control text last updated 21 May 2026 What else in your programme already covers this This control maps to 246 controls across 120 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
11.3.1 11.3.1 Quarterly internal vulnerability scans 11.3.1.1 11.3.1.1 Lower-risk vulnerabilities handled per risk analysis 11.3.1.2 11.3.1.2 Authenticated internal vulnerability scanning 11.3.1.3 11.3.1.3 Internal scans after significant change 11.3.2 11.3.2 Quarterly ASV external vulnerability scans 11.3.2.1 11.3.2.1 External scans after significant change 12.6.1 12.6.1 Formal security awareness program 5.3.2.1 5.3.2.1 Targeted risk analysis sets malware scan frequency 6.4.1 6.4.1 Public web application review or automated protection 6.3.1 6.3.1 Vulnerability identification and risk ranking 6.3.3 6.3.3 Timely installation of security patches CIS-13.3 Deploy a Network Intrusion Detection Solution CIS-16.2 Establish and Maintain a Process to Accept and Address Software Vulnerabilities CIS-16.3 Perform Root Cause Analysis on Security Vulnerabilities CIS-16.6 Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities CIS-7.1 Establish and Maintain a Vulnerability Management Process CIS-7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets CIS-7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets CIS-7.7 Remediate Detected Vulnerabilities E8-PATCHAPP-ML1 Patch Applications (ML1) E8-PATCHAPP-ML2 Patch Applications (ML2) E8-PATCHAPP-ML3 Patch Applications (ML3) E8-PATCHOS-ML1 Patch Operating Systems (ML1) E8-PATCHOS-ML2 Patch Operating Systems (ML2) E8-PATCHOS-ML3 Patch Operating Systems (ML3) RA-1 Policy and Procedures RA-5 Vulnerability Monitoring and Scanning RA-5(11) Vulnerability Monitoring and Scanning | Public Disclosure Program (RA-5(11)) RA-5(2) Update Vulnerabilities to be Scanned RA-5(3) Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage (RA-5(3)) RA-7 Risk Response RA-1 Policy and Procedures RA-5 Vulnerability Monitoring and Scanning RA-5(11) Vulnerability Monitoring and Scanning | Public Disclosure Program (RA-5(11)) RA-5(2) Update Vulnerabilities to be Scanned RA-5(3) Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage (RA-5(3)) NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions NIST-CSF-ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded NIST-CSF-ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded NIST-CSF-ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization NIST-CSF-ID.RA-09 The authenticity and integrity of hardware and software are assessed prior to acquisition and use ASBv3-NS-8 Detect and disable insecure services and protocols ASBv3-PV-6 Rapidly and automatically remediate vulnerabilities DS-2 Ensure software supply chain security PV-5 Perform vulnerability assessments API1164-07 Remote Access API1164-09 Patch and Vulnerability Management API1164-24 Vulnerability assessment for critical systems SEC06-BP01 Perform vulnerability management SEC06-BP05 Automate compute protection SEC11-BP02 Automate testing throughout the development and release lifecycle BSI-13 Risk assessment procedures BSI-15 Security categorization BSI-17 Continuous monitoring strategy C5-OPS-18 Managing Vulnerabilities, Malfunctions and Errors - Concept C5-OPS-19 Managing Vulnerabilities, Malfunctions and Errors - Penetration Tests C5-OPS-22 Testing and Documentation of known Vulnerabilities ISO23894-6.3 AI Risk Assessment ISO23894-6.3.1 AI Risk Identification ISO23894-6.3.3 AI Risk Evaluation 29134-1 Scope 29134-3 Terms and definitions 29134-9.1 PIA report structure 6.1.2 AI risk assessment 8.3 AI risk treatment 9.1 Monitoring, measurement, analysis and evaluation RMI-DD-2 Supply Chain Information Collection RMI-SEG-2 Environmental Standards RMI-SEG-3 OHS and Governance SOC2-CC3.2 CC3.2 Identifying and analysing risks to objectives (COSO principle 7) SOC2-CC7.1 CC7.1 Detecting configuration changes and new vulnerabilities SOC2-CC7.2 CC7.2 Monitoring system components for anomalies SSAE18-CC3.1 CC3.1 - COSO Principle 6: Risk Identification SSAE18-CC3.2 CC3.2 - COSO Principle 7: Risk Analysis SSAE18-SOC1-02 Risk Assessment ASD37-02 Patch applications (Essential) ASD37-19 Patch operating systems (Essential) IS.D.OR.205 Information Security Risk Assessment IS.I.OR.205 Information Security Risk Assessment Sapin2-Pillar3-Risk-Mapping Pillar 3 - Corruption Risk Mapping (Cartographie des Risques) Sapin2-Pillar4-ThirdParty-DueDiligence Pillar 4 - Third-Party Due Diligence (Clients, Suppliers, Intermediaries, M&A) ICAO-ANX17-Chap2-ThreatAssessment-RiskManagement-Cyber-GASeP ICAO Annex 17 Chapter 2 - Threat Assessment + Risk Management + Cyber Threats to Critical Aviation Systems (Amendment 17/18) ICAO-ANX17-Chap4-Cargo-Mail-Catering-Stores-Supplies-RegulatedAgent-KnownConsignor ICAO Annex 17 Chapter 4 - Cargo + Mail + Catering + Stores + Supplies Security + Regulated Agent + Known Consignor + Supply Chain IEC62443-07 Personnel risk assessment IEC62443-24 Vulnerability assessment for critical systems ISO27003-6.1 Actions to address risks and opportunities ISO27003-8.2 Information security risk assessment ISO27019-07 Personnel risk assessment ISO27019-24 Vulnerability assessment for critical systems 27557-4.3 Individual impact consideration 27557-6.3 Privacy risk assessment NZISM-1 NZISM Governance, Documentation, and Classification System NZISM-3 Personnel Security, Physical Security, and Cryptography ORSA-S1 Guidance Manual Section 1: Description of the insurer's risk management framework ORSA-S2 Guidance Manual Section 2: Insurer's assessment of risk exposures 2.4.4 Hazard Analysis and Risk Assessment 2.7.2 Food Fraud Plan ISMSP-MS-02 Risk Management ISMSP-SYS-04 Vulnerability Management CH-FADP-21 Data protection impact assessments FADP-7 Data Protection Impact Assessment (Articles 9-10) CRM-1 AML/CFT Compliance CRM-4 Business Risk Assessment UNESCO-AI-PA1 Ethical Impact Assessment UNESCOAI-1 Principles 1-3: Proportionality, Safety, Fairness AMLCTF-PartA-RiskAssess ML/TF Risk Assessment ANSSI-HYG-38 Carry Out Regular Security Checks and Audits and Apply the Corrective Actions CPS230-11 Identification, Assessment and Management of Operational Risk CPS234-P17 Active Maintenance of Capability Against Change SPS220-22 Framework Enabling Strategies, Policies, Procedures and Controls 4.3.1 Risk Assessment and Impact Analysis AUCDR-IS-4 Formal vulnerability management program AESCSF-TVM-1 Vulnerability management P1-S1 Advance Electronic Information BB-DPA-20 Sections 50-60 - Registration and Responsibilities STIG-ASSESS-SCAP SCAP automated benchmark scanning DODZT-2.5 Partially and Fully Automated Asset, Vulnerability and Patch Management EUAI-Art.72 Post-market monitoring by providers and post-market monitoring plan for high-risk AI systems UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21) B.9.2 B.9.2 Vulnerability Assessment ISO-22313-8.2 Business impact analysis and risk assessment ISO-26262-3-7 Hazard analysis and risk assessment (HARA) 8.8 Management of technical vulnerabilities 8.8 Management of technical vulnerabilities 6.9.6 Technical vulnerability management ISO27799-06 Security management process and risk analysis 27031-7.2 Resource Requirements 29147-5.11 Researcher Safe Harbour and Legal Posture NFPA1600-5.1 Risk Assessment Art.21.2.e Security in acquisition, development and maintenance, including vulnerability handling and disclosure 03.11.02 Vulnerability Monitoring and Scanning 3.12.1e Penetration Testing by Independent Agents RA-5 RA-5 Vulnerability Monitoring and Scanning RA-5 RA-5 Vulnerability Monitoring and Scanning RA-5 RA-5 Vulnerability Monitoring and Scanning NISTSP82-2 OT Risk Assessment and Threat/Vulnerability Identification NRFCS-2 Risk Assessment, Customer Data Inventory, Classification, and Retail Threat Model NJDPA-7 Data Protection Assessments and Processor Contracts NGOB-1 Open Banking Registry Participation, Tiered Categorisation, and KYP OECDAI-3 Robustness, Security, Safety, and Adversarial Attack Protection OECDMNE-5 Environment, Climate, and Biodiversity OREGONCPA-5 Data Protection Assessments, Privacy by Design, Security Practices PDPASG-4 Children's Data, DPIA, and Privacy by Design PDPATH-4 DPIA, Privacy by Design, Children's Data POPIASA-4 Special Personal Information, Children, Information Quality, Documentation PTES-3.3 Scope vulnerability analysis to the agreed depth and breadth NORWAY-4 DPIA, Privacy by Design, Records of Processing NZPRV-6 IPP 13 Unique Identifiers, Privacy Impact Assessment, Privacy by Design QATAR-7 DPO, Records, Retention, Marketing, Training PICERL-P2 Risk Assessment SECCLIM-2 Risk Management: Identification, Assessment, Integration SOC-CY-DC5 Risk Assessment Process SA-PDPL-21 Data protection impact assessments SOCI-S30CU Vulnerability assessments SCA-S10 Annual Risk Assessment IM8-SEC.4 Vulnerability Management PIPA-CPO-DPO-Privacy-Officer-PIA-Personal-Information-Impact-Assessment-Articles-31-33 Korea PIPA CPO + DPO + Privacy Officer + PIA + Personal Information Impact Assessment + Articles 31-33 TSAPIPE-1 Cybersecurity Implementation Plan and Coordinator TAIWAN-3 Data Subject Rights TEXASTDPSA-3 Sensitive Data, Children, Sale Notice UKAI-1 Risk-Based Approach and Pro-Innovation Principles Standard 2 Data Protection Impact Assessments CE-SU.3 Critical and High Updates within 14 Days UKOPRES-3 Self-Assessment and Board Engagement UKGDPRREG-3 Controller and Processor (Articles 24-43) s.54(5) Statement Content Requirements SEMD-SP-2 Risk Identification and Assessment UNICEFAI-4 Transparency, Explanation, Adult Capacity CPSC-RA.3 Lifecycle Risk Assessment 6(e) Sec. 6(e) (now 5(b)) Manage AI software vulnerabilities and compromises in vulnerability management URUGUAY-5 Database Registration with AGESIC URCDP VIETNAMPDP-3 Data Subject Rights VIRGINIAVCDPA-3 Sensitive Data Consent and Children Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Other controls in RA - Risk Assessment You are reading one control. How much of NIST SP 800-53 Rev 5 have you already done? NIST SP 800-53 Rev 5 NIST800-RA-5 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-53 Rev 5 your existing evidence covers. Hold ISO 27001:2022 and 163 of 1014 NIST SP 800-53 Rev 5 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 342 were rejected on the ISO 27001:2022 pair alone.
Query this from an agent The graph holds this control, the 246 it maps to, and the evidence behind each claim, over MCP and REST.