The system must employ automated mechanisms or must have an application installed that, on an organization defined frequency, determines the state of information system components with regard to flaw remediation.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-36734	WN12-GE-000023	SV-51582r1_rule	VIVM-1	Medium

Description
Organizations are required to identify information systems containing software affected by recently announced software flaws (and potential vulnerabilities resulting from those flaws) and report this information to designated organizational officials with information security responsibilities (e.g., senior information security officers, information system security managers, information systems security officers). To support this requirement, an automated process or mechanism is required.

Description

Organizations are required to identify information systems containing software affected by recently announced software flaws (and potential vulnerabilities resulting from those flaws) and report this information to designated organizational officials with information security responsibilities (e.g., senior information security officers, information system security managers, information systems security officers). To support this requirement, an automated process or mechanism is required.

STIG	Date
Windows Server 2012 / 2012 R2 Member Server Security Technical Implementation Guide	2014-12-18

Details

Check Text ( C-46845r1_chk )
Verify the organization has an automated process to scan systems for identified software flaws and vulnerabilities. If it does not, this is a finding.

Fix Text (F-44711r1_fix)
Establish an automated process to scan systems for identified software flaws and vulnerabilities.