Virtual machines should have a vulnerability assessment solution enabled

SOC 2

• CC3.2 COSO Principle 7: The entity identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed
• CC7.1: To meet its objectives, the entity uses detection and monitoring procedures to identify (1) changes to configurations that result in the introduction of new vulnerabilities, and (2) susceptibilities to newly discovered vulnerabilities.

NIS2 Directive (EU 2022/2555)

• 3 Incident handling
• 5 Supply chain security
• 6 Security in network and information systems acquisition, development and maintenance

NIST SP 800-53 Rev 5

• RA-5 Vulnerability Monitoring and Scanning
• SI-2 Flaw Remediation

NIST Cybersecurity Framework v2.0

• ID.AM-02
• ID.AM-08
• ID.IM-02
• ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded.
• ID.RA-04: Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded.

NIST SP 800-171 Rev 2

• 3.11.2 Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified
• 3.11.3 Remediate vulnerabilities in accordance with risk assessments
• 3.14.1 Identify, report, and correct system flaws in a timely manner

CIS Azure Benchmark v4.0.0

• 9.1.3.2 Ensure that 'Vulnerability assessment for machines' component status is set to 'On'

CIS Azure Benchmark v5.0.0

• 8.1.3.2 Ensure that 'Vulnerability assessment for machines' component status is set to 'On'

RBI Cyber Security Framework for UCBs

• Annex I (6)

RBI IT Framework for NBFCs

• 1 IT Governance
• 3.3 Vulnerability Management
• 4.4.a IT Operations

BSI C5:2025

• OPS-04.01B Policies and instructions with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects: - Use of system-specific protection mechanisms;- Operating protection programmes on system components...
• OPS-05.01AS If protection programmes are set up with signature and behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at the highest frequency that the vendor(s) contractually offer(s).
• OPS-05.02B If protection programmes are set up with signature or behaviour-based malware detection and removal, these protection programmes are regularly updated with the latest malware definitions when such updates are available, at least on a daily basis.

CIS Azure Benchmark v2.0.0

• 2.1.16 Ensure that Auto provisioning of 'Vulnerability assessment for machines' is Set to 'On'

CIS Azure Benchmark v2.1.0

• 2.1.15 Ensure that Auto provisioning of 'Vulnerability assessment for machines' is Set to 'On'

CIS Azure Benchmark v3.0.0

• 3.1.3.2 Ensure that 'Vulnerability assessment for machines' component status is set to 'On'

FedRAMP High

• RA-5 Vulnerability Scanning
• SI-2 Flaw Remediation

HIPAA HITRUST v9.2

• 0709.10m1Organizational.1-10.m 10.06 Technical Vulnerability Management
• 0711.10m2Organizational.23-10.m 10.06 Technical Vulnerability Management

PCI DSS v3.2.1

• 6.6 For public-facing web applications, ensure that either one of the requirements are in place
• 11.2.1: Perform quarterly internal vulnerability scans and rescans as needed, until all "high-risk" vulnerabilities (as identified in Requirement 6.1) are resolved. Scans must be performed by qualified personnel.
• Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor- supplied security patches
• For a sample of system components including all operating system types commonly affected by malicious software, verify that anti-virus software is deployed if applicable anti-virus technology exists