# Vulnerability scanning checklist

Original SecNet teaching template. All examples are fictional. Do not put secrets in this file.

v1.0 / 2026-10-20

## Define scope and engagement rules

- [ ] Record the owner, IP/CIDR and domain list, exclusions, schedule, source IP, request limits and emergency contact. Confirm third-party assets separately.
- [ ] Verify segment reachability internally and DNS, CDN and asset ownership externally. Separate critical services from the small pilot group.
- [ ] Evidence / output: Approved scope inventory + rules of engagement

## Validate visibility and inventory

- [ ] Reconcile CMDB, cloud inventory and DNS records. Perform controlled service discovery only on approved targets; map each asset to technical and business owners.
- [ ] Separate reachable, unreachable and excluded assets. Record sensor placement and firewall effects in the report.
- [ ] Evidence / output: Target–owner–sensor mapping + reachability gaps

## Prepare the scanning profile

- [ ] Choose current check feeds, a scope-appropriate port list, timeouts and concurrency. For credentialed scans use a separate, traceable account with required permissions; keep passwords out of reports.
- [ ] Check authentication success in tool output. For web scans verify that sessions remain authenticated and out-of-scope URLs are excluded.
- [ ] Evidence / output: Versioned profile + successful access validation

## Start with a small monitored pilot

- [ ] Begin with a representative, lower-impact asset group. Monitor service health, latency and errors with operations. Stop when agreed load or outage thresholds are exceeded.
- [ ] Expand scope gradually after the pilot. Validate active web tests in non-production first; do not apply generic IT profiles to OT/ICS without vendor approval and a safety assessment.
- [ ] Evidence / output: Pilot record + execution timeline + stop events

## Validate candidate findings

- [ ] Deduplicate by asset and root cause. Check version, installed package, configuration, backported fixes and reachability evidence. Do not execute an exploit when safe inspection is sufficient.
- [ ] Record evidence and rationale for false positives, and uncertainty for untested areas. Redact personal data, tokens and passwords in attachments.
- [ ] Evidence / output: Validated finding + evidence reference + confidence

## Prioritize using business risk

- [ ] Assess CVSS technical severity alongside internet exposure, known exploitation, EPSS, asset criticality, data and existing controls. Do not add unlike scores as though they measure the same thing.
- [ ] Assign each validated finding an owner, organization-approved deadline and remediation plan. Document temporary mitigation and time-bound risk acceptance when delayed.
- [ ] Evidence / output: Prioritized backlog + owner + due date

## Remediate, retest and measure

- [ ] Apply patches, configuration or access restrictions through change management. Retest from the same viewpoint with appropriate checks; also verify that the service still works.
- [ ] Retain before/after evidence, profile version and retest date. Reassess after new assets or significant changes; choose cadence based on risk and applicable requirements.
- [ ] Evidence / output: Retest evidence + closure decision + tracking metrics