Applies to all IP-addressable network assets that can be reached over IPv4 and IPv6 protocols

Scope includes servers and workstations, virtual machines, routers and switches, firewalls, network appliances, and network printers whether in on-premises, roaming, or cloud-operated deployment models

Scope excludes ephemeral assets and third-party managed SaaS solutions
Solutions that can help:

Vulnerability enumeration performed on managed endpoints and managed network devices must be conducted with privileged credentials (either network-based credentialed scans or client/agent-based)

Vulnerability detection signatures used must be 24 hours from the last vendor-released signature update

The same type of vulnerability enumeration must be performed on mobile and other devices that reside outside of agency on-premises networks

Any alternative asset discovery and vulnerability enumeration methods must be approved by CISA
Solutions that can help:

Initiate collection and reporting of vulnerability performance data to the CDM Dashboard

Reporting in Vulnerability reporting clouds data points or measurements that use automation and machine-level data such as logs/events indicating successful credentialed enumeration completion, date/timestamps of enumeration activities, and signature/plug-in update date/timestamps, etc.
Solutions that can help: