RA-5, in the Risk Assessment control family, is one of the most direct vulnerability-scanning mandates in any major framework — it names scanning explicitly. Here's what the control requires, and how Vooki Pro's scans and reports support it.
Organizations define their own scan frequency (or random-interval selection), but the control also requires scanning when newly reported vulnerabilities are identified that could affect the system — a scheduled cadence alone isn't the full requirement.
Tooling should support standardized formats for platforms, software flaws and misconfigurations, checklists and test procedures, and impact measurement — enabling automation and consistent comparison across tools and time.
Scan reports must be analyzed and legitimate vulnerabilities remediated within organization-defined response times tied to a risk assessment — and findings shared with defined personnel, partly to help prevent the same flaw recurring elsewhere in the organization.
Scanning tools must be updatable so newly disclosed vulnerabilities aren't silently missed — an ongoing operational requirement, not a one-time setup step.
Summary of the NIST SP 800-53 Rev. 5 RA-5 control, not the catalog's text. Programs built on the catalog, such as FedRAMP, set their own scanning and remediation timeframes — check that program's current requirements.
Scheduled, recurring scans on whatever cadence your organization defines support the application-layer portion of RA-5 for your web applications and APIs. CVSS scoring on each finding supports risk-based remediation timeframes; automated retest records what the originating detector found when a fix was retested; and the findings browser, filterable by scan and severity, supports the "share findings with defined personnel" element.
RA-5 sits within a 20-family control catalog covering access control, configuration management, incident response, and far more — RA-5 is one control among well over a thousand across the full catalog. Vooki Pro addresses the application-layer vulnerability-scanning piece specifically, not infrastructure/network scanning or the rest of the RA family. RA-5's wider responsibilities — scanning the whole system, keeping tools updated, analyzing results, remediating within your response times, and sharing information — extend beyond DAST.
Exporting a scan as a NIST SP 800-53 report (HTML or PDF, via the Export menu or the CLI's compliance_framework: nist config) produces a NIST SP 800-53 Rev. 5 mapping: each finding is referenced against the controls it bears on, such as AC-3 (access enforcement), SI-10 (information input validation) and SC-8 (transmission confidentiality and integrity). RA-5 covers the scanning activity itself — your dated scans and their reports are evidence of that activity, but RA-5 is not one of the controls findings are mapped to.
See the CLI & CI/CD docs for automated scheduled scanning · or browse other frameworks
NIST SP 800-53 Rev. 5 (official catalog, csrc.nist.gov)
FedRAMP — Risk Assessment controls (Rev. 5)
Vooki Pro documentation: Reports & Compliance · Scan Results & Findings · CLI & CI/CD
Last reviewed 23 October 2026.
No credit card required — submit a trial request; the team reviews it, then sends your trial license and installation instructions.