NIST ID.RA-1: Asset Vulnerability Identification
Vulnerability identification is the foundation of effective risk management. NIST Cybersecurity Framework control ID.RA-1 requires organizations to systematically discover, document, and track vulnerabilities across all assets. Without visibility into what's vulnerable, you can't prioritize remediation or demonstrate compliance to auditors.
What this means
ID.RA-1 mandates that your organization maintains a complete, documented inventory of vulnerabilities affecting hardware, software, and cloud assets. This goes beyond ad-hoc scanning—you need a continuous process that identifies weaknesses, records them with severity and affected assets, and feeds data into your risk management program. The control ensures vulnerabilities are known, communicated across teams, and tracked to resolution.
How to comply
- 1.Establish an automated vulnerability scanning program covering all asset types (servers, endpoints, network devices, cloud resources, web applications)
- 2.Create and maintain a centralized vulnerability register with asset ownership, severity ratings, affected systems, and discovery dates
- 3.Define scan frequency based on asset criticality (critical systems weekly, standard assets monthly minimum)
- 4.Document your vulnerability identification methodology, tools used, and roles responsible for scanning and reporting
- 5.Implement a process to correlate vulnerabilities with your asset inventory to ensure complete coverage
- 6.Set remediation timelines based on severity and business impact, with tracking mechanisms
- 7.Review and update vulnerability data at least quarterly to catch newly discovered issues
Evidence auditors look for
- Vulnerability scan reports from tools like Qualys, Nessus, or OpenVAS with timestamps and asset details
- Documented vulnerability management policy defining scan scope, frequency, and severity classifications
- Vulnerability register or database showing discovered vulnerabilities, affected assets, severity, and remediation status
- Asset inventory linked to vulnerability data demonstrating traceability
- Scan execution logs and scheduling documentation proving regular scanning cadence
- Risk assessment reports showing how vulnerabilities feed into overall organizational risk calculations
- Remediation tracking records with evidence of fixes applied and verification scans
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automatically centralizes vulnerability scan data from multiple tools, continuously monitors your asset inventory against discoveries, and generates audit-ready evidence reports—eliminating manual log aggregation and ensuring no vulnerabilities slip through the cracks.
See how GRCWatch handles this control automatically
Start free trial