| Source | Azure Portal | ||
| Display name | Microsoft Managed Control 1546 - Vulnerability Scanning | ||
| Id | 2ce1ea7e-4038-4e53-82f4-63e8859333c1 | ||
| Version | 1.0.0 Details on versioning |
||
| Category | Regulatory Compliance Microsoft Learn |
||
| Description | Microsoft implements this Risk Assessment control | ||
| Additional metadata |
Name/Id: ACF1546 / Microsoft Managed Control 1546 Category: Risk Assessment Title: Vulnerability Scanning - Frequency of Scanning, Identifying, Reporting Ownership: Customer, Microsoft Description: The organization: Scans for vulnerabilities in the information system and hosted applications monthly (for operating systems, web applications, and databases) and when new vulnerabilities potentially affecting the system/applications are identified and reported; Requirements: Azure implements vulnerability scanning by actively scanning servers, network devices, databases, and web applications in the Azure inventory with authenticated scans. All scans are performed monthly. The vulnerability scanning tools provide Azure updates as new vulnerabilities are identified and reported. Scans are also performed when newly identified vulnerabilities are added for each type of scan. The C+AI VSA team within Azure manages the vulnerability management program and provides scanning services for the environment. C+AI VSA is responsible for the identification, assessment, and notification of vulnerabilities to Azure personnel, who are responsible for the remediation of verified vulnerabilities on operating systems, network elements and applications deployed in the Azure environment. Listed below are the assets scanned each month in accordance with the monthly assignment:* Operating system (OS) Scans Conducted twice a day * Host, Guest, Native, and Pilotfish server environment * Physical server environment * Monthly operating system (OS) Scans * Azure network devices * Monthly database (DB) scans * SQL DB instances * Monthly web application scans * Web applications (hosted URLs) In addition, the Third Party Assessment Organization (3PAO) satisfies the requirements for independent third-party security assessment and scanning on an annual basis. This is done by having the Third Party Assessment Organization (3PAO) review the scanning configuration, observe the scan where possible, and review the results. |
||
| Mode | Indexed | ||
| Type | Static | ||
| Preview | False | ||
| Deprecated | False | ||
| Effect | Fixed audit |
||
| RBAC role(s) | none | ||
| Rule aliases | none | ||
| Rule resource types | IF (2) Microsoft.Resources/subscriptions Microsoft.Resources/subscriptions/resourceGroups |
||
| Compliance | Not a Compliance control | ||
| Initiatives usage | none | ||
| History | none | ||
| JSON compare | n/a | ||
| JSON |
|