CIS Controls Vulnerability Scanning: Control 7

Vulnerability scanning for CIS Controls

CIS Controls version 8 gives vulnerability management its own control, Control 7, and it is one of the few frameworks that spells out the cadence. If you follow the CIS Controls, or a customer or insurer asks you to, this page explains what the safeguards require and which Clone Systems package covers each one.

What CIS actually says

Control 7, Continuous Vulnerability Management, has seven safeguards. 7.1 and 7.2 ask for a documented vulnerability management and remediation process. 7.3 and 7.4 ask for automated operating system and application patching. 7.5 asks for automated, authenticated vulnerability scans of internal enterprise assets quarterly or more often. 7.6 asks for automated vulnerability scans of externally exposed assets quarterly or more often. 7.7 asks for remediation based on the process. Safeguards 7.5 and 7.6 are the scanning requirements, and both are Implementation Group 2.

What your auditor needs to see

Authenticated (credentialed) internal scan reports at least quarterly, covering endpoints and servers.
External scan reports at least quarterly.
A written remediation process with timelines by severity.
Evidence that findings were patched or accepted as exceptions.
A current asset inventory the scans line up with.

Getting it done this week

Clone Systems agent-based vulnerability scanning covers laptops, workstations and servers wherever they are, with an authenticated scan from inside each one and is ready the moment you check out. Agent-based scanning is $1,195 a year for 25 agents, $3,995 for 100, $7,995 for 250. Add external vulnerability scanning for your externally exposed systems. External scanning is $595 a year for 10 IPs, $2,495 for 50, $5,985 for 150. For a network scanner inside the office instead of agents, internal vulnerability scanning covers the same safeguard. Every package includes free rescans, and reports export mapped to CIS Controls from the portal.

Why Clone Systems

PCI Approved Scanning Vendor since 2007, the same scanning engine tested every year under the PCI Council's ASV program, published prices, buy online. Switching from another scanner? See how it works.

Buy vulnerability scanning · Talk to our scanning team

Clone Systems is a PCI Security Standards Council Approved Scanning Vendor, listed since 2007. This page is general guidance, not legal or audit advice.