11.3.1.2External and internal vulnerabilities are regularly identified, prioritized, and addressed

Defined Approach Requirements:

Internal vulnerability scans are performed via authenticated scanning as follows:

- Systems that are unable to accept credentials for authenticated scanning are documented.

- Sufficient privileges are used for those systems that accept credentials for scanning.

- If accounts used for authenticated scanning can be used for interactive login, they are managed in accordance with Requirement 8.2.2

Defined Approach Testing Procedures:

11.3.1.2.a Examine scan tool configurations to verify that authenticated scanning is used for internal scans, with sufficient privileges, for those systems that accept credentials for scanning.

11.3.1.2.b Examine scan report results and interview personnel to verify that authenticated scans are performed.

11.3.1.2.c If accounts used for authenticated scanning can be used for interactive login, examine the accounts and interview personnel to verify the accounts are managed following all elements specified in Requirement 8.2.2.

11.3.1.2.d Examine documentation to verify that systems that are unable to accept credentials for authenticated scanning are defined.