RA-5, in the Risk Assessment control family, is one of the most direct vulnerability-scanning mandates in any major framework — it names scanning explicitly. Here's what the control requires, and how Vooki Pro's scans and reports support it.
"Start 7-Day Trial" submits a request — Vooki Pro's team reviews it and sends the trial license and installation instructions; it is not an instant self-serve activation.
Organizations define their own scan frequency (or random-interval selection), but the control also requires scanning when newly reported vulnerabilities are identified that could affect the system — a scheduled cadence alone isn't the full requirement.
Tooling should support standardized formats for platforms, software flaws and misconfigurations, checklists and test procedures, and impact measurement — enabling automation and consistent comparison across tools and time.
Scan reports must be analyzed and legitimate vulnerabilities remediated within organization-defined response times tied to a risk assessment — and findings shared with defined personnel, partly to help prevent the same flaw recurring elsewhere in the organization.
Scanning tools must be updatable so newly disclosed vulnerabilities aren't silently missed — an ongoing operational requirement, not a one-time setup step.
Sourced from the FedRAMP-hosted copy of the NIST SP 800-53 Rev. 5 catalog (RA-5). Specific remediation-timeframe figures sometimes cited alongside RA-5 (e.g. monthly/weekly scan cadences, 15/30-day remediation windows) come from FedRAMP program policy layered on top of the base NIST control, not the NIST text itself — we have not independently confirmed FedRAMP's current figures and have left exact numbers out of this page.
Scheduled, recurring scans on whatever cadence your organization defines directly satisfy RA-5's core scanning requirement for the web-application and API layer. CVSS scoring on each finding supports risk-based remediation timeframes; automated retest documents that remediation actually happened; and the findings browser, filterable by scan and severity, supports the "share findings with defined personnel" element.
RA-5 sits within a 20-family control catalog covering access control, configuration management, incident response, and far more — RA-5 is one control among well over a thousand across the full catalog. Vooki Pro addresses the application-layer vulnerability-scanning piece specifically, not infrastructure/network scanning or the rest of the RA family.
Exporting a scan as a NIST SP 800-53-mapped report (HTML or PDF, via the Export menu or the CLI's compliance_framework: nist config) gives you dated, reproducible documentation to support RA-5 evidence collection — including for programs like FedRAMP that build on the 800-53 catalog.
See the CLI & CI/CD docs for automated scheduled scanning · or browse other frameworks
NIST SP 800-53 Rev. 5 (official catalog, csrc.nist.gov)
FedRAMP — Risk Assessment controls (Rev. 5)
Vooki Pro: live features.html, docs/reports.html, docs/cli.html, docs/findings.html (verified 2026-10-23).
No credit card required — submit a request and the team will send your trial license and installation instructions.