How often do I need to run vulnerability scans for CMMC?

3.11.2 doesn't fix a number — you define the frequency in your policy and then meet it, plus scan when significant new vulnerabilities emerge. Monthly authenticated scans are a common, defensible cadence; document whatever you choose and stick to it.

Is vulnerability scanning the same as flaw remediation?

No. 3.11.2 is finding vulnerabilities (scanning). Fixing them in a timely way is flaw remediation (3.14.1). Assessors look for both the scans and evidence that findings get remediated.

CMMC 3.11.2 (Vulnerability Scanning): Evidence Examples & What Assessors Actually Check

Q: What does CMMC 3.11.2 require?

Scan for vulnerabilities in your systems and applications on a defined frequency, and again whenever new vulnerabilities affecting them are identified. You must define the cadence, scan both systems and applications, and scan on new-vulnerability events.

Control: NIST SP 800-171 Rev. 2 §3.11.2 · CMMC Practice: RA.L2-3.11.2 · Updated October 2026

Plain-English answer

3.11.2 requires you to scan for vulnerabilities in your organizational systems and applications on a defined frequency, and again when new vulnerabilities affecting them are identified. Three things an assessor checks: you defined a cadence, you actually scan on it (systems and apps), and you scan on new-vulnerability events — not just once a year.

Who this applies to

Every organization that must implement NIST SP 800-171, under DFARS 252.204-7012 or a CMMC Level 2 requirement. The requirement covers your organizational systems and applications. Your CMMC assessment scope (32 CFR 170.19) decides which assets an assessor samples, not which assets you scan.

Why it matters

You can't fix what you don't find. Scanning is how known vulnerabilities surface before an adversary uses them. For point values, see the CMMC Scoring Methodology (32 CFR 170.24).

Control lineage

CMMC Practice: RA.L2-3.11.2
NIST 800-171 Rev. 2: §3.11.2 — scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting them are identified.
NIST 800-171A objectives: [a] the frequency to scan for vulnerabilities in organizational systems and applications is defined; [b] vulnerability scans are performed on organizational systems with the defined frequency; [c] vulnerability scans are performed on applications with the defined frequency; [d] vulnerability scans are performed on organizational systems when new vulnerabilities are identified; [e] vulnerability scans are performed on applications when new vulnerabilities are identified.

What the assessor will EXAMINE

The vulnerability-management policy defining scan frequency for systems and applications.
Scan reports over time showing the cadence is met (authenticated scans preferred).
Coverage: scans reach every organizational system and application in your inventory, not a subset.
Evidence of event-driven scans when major vulnerabilities emerged.
SSP narrative for 3.11.2.

What the assessor will INTERVIEW & TEST

Interview: "How often do you scan, what's covered, and what triggers an off-cycle scan?" — point to the policy + the scan history.
Test: Review recent scan reports for cadence, coverage, and that they're authenticated (not just unauthenticated network scans).
Test: Pick assets from the inventory and confirm each appears in recent scan results.

Evidence examples (produce these)

Vulnerability-management policy with defined scan frequency.
A series of dated scan reports (systems and applications) showing the cadence.
Asset coverage proof: scan targets reconciled to your full system and application inventory (3.4.1 baseline inventory).
An example off-cycle scan tied to a new vulnerability.
SSP section 3.11.2 referencing the above.

Common failure patterns

Scanning happens but no defined frequency is documented — objective [a] fails.
Only unauthenticated scans, which miss most host-level vulnerabilities.
Systems scanned but applications aren't — objectives [c]/[e] fail.
Coverage gaps: systems or applications left out of scans because someone decided they were "out of CMMC scope". 3.11.2 covers organizational systems and applications.

SPRS impact & POA&M

SPRS: For point values, see the CMMC Scoring Methodology (32 CFR 170.24). POA&M: 3.11.2 cannot be on a Level 2 POA&M. 32 CFR 170.24 gives it a point value above 1, and 32 CFR 170.21(a)(2)(ii) allows only 1-point requirements (the one exception is SC.L2-3.13.11). It has to be MET at assessment.

Assessor-ready summary

You're good on 3.11.2 when a scan frequency is defined and met for both organizational systems and applications; scans are authenticated and cover the full inventory; off-cycle scans run on new vulnerabilities; and the SSP matches the practice. (Finding vulnerabilities is only half — remediating them is flaw remediation, 3.14.1.)

Can you show a clean scan history with full coverage? Use the Level 2 self-assessment checklist →

Athena prepares organizations for CMMC Level 2; certification rests with C3PAOs/DIBCAC. Verify all control facts against NIST SP 800-171 Rev. 2, NIST SP 800-171A, and current CMMC rules.