Management · Security Management
Vulnerability assessment and validation
Authorized vulnerability scanning and remediation validation, connected to RDA’s risk and service workflows.
Features and benefits
| Feature | Practical benefit |
|---|---|
| Asset and service discovery | Authorized scanning identifies reachable systems and exposed services so assessment coverage can be checked against inventory. |
| Vulnerability and patch checks | Plugin-based findings identify known weaknesses and missing updates for targeted remediation. |
| Authenticated configuration assessment | Credentialed checks inspect system configuration more deeply; supported audit policies help compare settings with a chosen baseline. |
| Prioritized findings | Severity and technical detail help assign corrective work, with business impact and accepted risk supplied through RDA’s assessment workflow. |
| Reports and remediation retests | Exports and repeat scans provide a record of findings and whether the specific technical issue was corrected. |
Vulnerability assessment and validation
Connect scan coverage and findings to business decisions, corrective work and retesting.
Requirements → deployment → operation → validation
Document library
Requirements and security baseline
Vulnerability assessment and validation Requirements and security baseline
Baseline alignment. Vulnerability assessment and remediation priorities aligned with the agreed CIS IG. CIS IGs
- Authorized targets, asset coverage and scanning exclusions
- Safe vulnerability and configuration-audit policies with protected scan credentials
- Finding ownership, business-risk decisions and remediation retest criteria
Deployment and control mapping
Vulnerability assessment and validation Deployment and control mapping
- Scope and ownership: Authorized vulnerability scanning and remediation validation, connected to RDA’s risk and service workflows.
- Approved rollout and acceptance: Pilot targets and a safe approved scan policy; reachability and credentialed-check acceptance
- Applicable requirements mapped to configuration, validation evidence and approved exceptions
Client and user guide
Vulnerability assessment and validation Client and user guide
- Scan scope, expected impact and maintenance coordination
- Business ownership and reporting suspected scan disruption
- How findings and accepted risks are communicated
Technician training outline
Vulnerability assessment and validation Technician training outline
- Scan configuration and credentialed-check validation
- Finding interpretation, false positives and business context
- Remediation tickets, risk acceptance and retesting
RDA technician workflow
Vulnerability assessment and validation RDA technician workflow
- Identify and assess the requirement; plan the scope, accountable owner and required approvals
- Implement and verify: Compare scan targets with inventory, verify credentialed coverage and rescan a corrected finding before closing its action.
- Document the configuration and result; hand off operation, review exceptions and plan lifecycle changes
Portal and access training
Vulnerability assessment and validation Portal and access training
- Scanner access and least-privilege operator roles
- Protected scan credentials and authorized target boundaries
- Report access, exports and access review
Training module template
Vulnerability assessment and validation Training module template
- Learning objectives and prerequisites: scan configuration and credentialed-check validation
- Authorized practical exercise: Compare scan targets with inventory, verify credentialed coverage and rescan a corrected finding before closing its action.
- Knowledge check, observed result and instructor or responsible-owner sign-off
Basic installation and acceptance
Vulnerability assessment and validation Basic installation and acceptance
- Supported scanner prerequisites and plugin updates
- Pilot targets and a safe approved scan policy
- Reachability and credentialed-check acceptance
Advanced deployment and changes
Vulnerability assessment and validation Advanced deployment and changes
- Expanded target groups and workload-specific policies
- Credentialed coverage and controlled scan optimization
- Recurring scans, exclusions and change coordination
Technical configuration and integrations
Vulnerability assessment and validation Technical configuration and integrations
- Target discovery, credentials and network reachability
- Report formats, identifiers and ticket handoff
- Scan evidence retention and risk-register linkage
Operational audit and checklist
Vulnerability assessment and validation Operational audit and checklist
- Coverage and operating checks: scan freshness, plugin status and failed or unreachable targets
- Evidence sample: scan output with target, policy and scan date; remediation decisions, linked tickets and clean or explained retests
- Review date and owner; pass or fail, exceptions, corrective action and retest evidence
Tabletop exercises
Vulnerability assessment and validation Tabletop exercises
- A critical vulnerability affects an essential service
- A scan misses a device or runs without usable credentials
- Remediation cannot proceed within the planned window
Response playbook
Vulnerability assessment and validation Response playbook
- Validate the finding and assess business exposure
- Choose remediation, compensating measures or approved risk acceptance
- Retest the technical result and update the risk record
Operational runbooks
Vulnerability assessment and validation Operational runbooks
- Run an authorized scan and check credential success
- Create a finding record with asset and business context
- Rescan remediation and retain the validation result
Evaluation and lifecycle review
Vulnerability assessment and validation Evaluation and lifecycle review
Selection and fit. Compare viable options against the business need, security requirements, existing systems and full operating cost. Record the reasons for the selection, the tradeoffs accepted and the conditions that would prompt a different choice.
Keeping the choice current. Follow supplier notices between scheduled reviews and reassess before renewal or a material change. Check ownership changes, renamed or retired products, subscription and licensing terms, pricing, capabilities and support commitments. Record the effect on security, data handling, integrations and service continuity. Assign an owner to approve adjustments or plan a transition, including data export and removal of access.
- Coverage and authenticated assessment quality
- Scan safety, report usefulness and supported workloads
- License scope, remediation handoff and operating cost