RA.L2-3.11.2
Vulnerability Scan
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee RA.L2-3.11.2 in the reference catalog with its NIST cross-references
Official requirement
Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.
Assessment objectives
a. the frequency to scan for vulnerabilities in organizational systems and applications is defined;
b. vulnerability scans are performed on organizational systems with the defined frequency;
c. vulnerability scans are performed on applications with the defined frequency;
d. vulnerability scans are performed on organizational systems when new vulnerabilities are identified; and
e. vulnerability scans are performed on applications when new vulnerabilities are identified.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Scan systems and applications for vulnerabilities periodically and when relevant new vulnerabilities emerge.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are a system administrator. Your organization has assessed its risk and determined that it needs to scan for vulnerabilities in systems and applications once each quarter [a]. You conduct some tests and decide that it is important to be able to schedule scans after standard business hours. You also realize that you have remote workers and that you will need to be sure to scan their remote computers as well [b]. After some final tests, you integrate the scans into normal IT operations, running as scheduled [b,c]. You verify that the scanner application receives the latest updates on vulnerabilities and that those are included in future scans [d,e].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Risk assessment policy; procedures addressing vulnerability scanning; risk assessment; system security plan; security assessment report; vulnerability scanning tools and associated configuration documentation; vulnerability scanning results; patch and vulnerability management records; other relevant documents or records
Common mistakes
Running a fixed scan schedule without responding to newly identified relevant vulnerabilities.