BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

SA-15(07) Automated Vulnerability Analysis

NIST SP 800-53 (controls) 5.2.0 against 5.2.0
All changes in this version
unchanged SA part of SA-15

Title

Automated Vulnerability Analysis

Control

Require the developer of the system, system component, or system service [Assignment: frequency] to:
(a) Perform an automated vulnerability analysis using [Assignment: tools];
(b) Determine the exploitation potential for discovered vulnerabilities;
(c) Determine potential risk mitigations for delivered vulnerabilities; and
(d) Deliver the outputs of the tools and results of the analysis to [Assignment: personnel or roles].

Discussion

Automated tools can be more effective at analyzing exploitable weaknesses or deficiencies in large and complex systems, prioritizing vulnerabilities by severity, and providing recommendations for risk mitigations.

Parameters

sa-15.07_odp.01: frequency
sa-15.07_odp.02: tools
sa-15.07_odp.03: personnel or roles

Related controls

ra-5, sa-11

STIG rules that implement this control 0

No followed STIG rule cites a CCI indexed to this control (CCI list 2026-07-14).