What CMMC actually says
CMMC Level 2 maps to the 110 requirements of NIST SP 800-171. Practice RA.L2-3.11.2 requires scanning for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems are identified. Practice RA.L2-3.11.3 requires remediating vulnerabilities in accordance with risk assessments. SI.L2-3.14.1 adds identifying, reporting and correcting system flaws in a timely manner. Assessors score each practice met or not met, so missing scan evidence costs points you cannot afford.
What your auditor needs to see
- Scan reports for every system in the CUI boundary, internal and external.
- A defined scanning cadence in your System Security Plan, with scans that match it.
- Scans after major vulnerability announcements, not only on the schedule.
- Findings prioritized by risk with remediation dates.
- Rescan evidence and a Plan of Action for anything still open.
Getting it done this week
Clone Systems internal vulnerability scanning covers the servers, workstations and network devices inside your CUI boundary and is ready the moment you check out. Internal scanning is $1,095 a year for 128 IPs, $1,495 for 512, $2,295 for 2,048. Add external vulnerability scanning for your internet-facing systems. External scanning is $595 a year for 10 IPs, $2,495 for 50, $5,985 for 150. Every package includes free rescans, and reports export mapped to CMMC from the portal.
Why Clone Systems
PCI Approved Scanning Vendor since 2007, the same scanning engine tested every year under the PCI Council's ASV program, published prices, buy online. Switching from another scanner? See how it works.
Buy vulnerability scanning · Talk to our scanning team
Related
- Vulnerability assessment services
- Vulnerability scanning for NIST 800-53
- Switch your vulnerability scanner
- Agent-based scanning
Clone Systems is a PCI Security Standards Council Approved Scanning Vendor, listed since 2007. This page is general guidance, not legal or audit advice.