Business Blog
Free vulnerability scanning for your business
You know the importance of strong cybersecurity, but have you heard about free vulnerability testing? As part of its mission to protect the nation’s cyber infrastructure, the Department of Homeland Security’s Cyber-Infrastructure Security Agency (CISA) offers free vulnerability scanning to government, critical infrastructure, and private businesses.
What does this mean for you? You may be eligible for no-cost vulnerability scanning that will continuously check your internet-facing assets. The testing checks for known vulnerabilities and weak configuration, then recommends ways to improve your security. Using commercial vulnerability scanners, each host is evaluated against a library of vulnerabilities.
How does it work? To get started, contact CISA at NCATS_INFO@hq.dhs.gov. Next, they’ll send you documents to return and sign, confirm a scanning schedule, and send you a pre-scan notification. After CISA processes your request, they’ll start scanning for vulnerabilities within 72 hours. Once it’s set up, the service is automated and requires very little direct interaction. Within two weeks, you’ll start getting weekly summary reports, with vulnerability mitigation recommendations.
Still not sure it’s right for your business? CISA has created a Cyber Hygiene Sample Report so you can see what to expect. The report identifies the number of vulnerable hosts and ranks vulnerabilities by severity (critical, high, medium, low) to help you prioritize remediation efforts. When you get the report, it’s up to you to take the steps to address any issues it identified. The report also shows changes since your previous report, including a list of vulnerabilities that you’ve mitigated.
Worried about who else is going to find out about your company’s vulnerabilities? Your password-protected Cyber Hygiene Report gets delivered to a single address within your company. CISA says that they will not share information that’s attributable to a specific company, without your company’s written consent. They use anonymized data to develop reports for trending and analysis.
These vulnerability scans offer one more tool in your company’s cybersecurity toolbox. For more tips and tools, check out the FTC’s Cybersecurity for Small Business and Start with Security materials.
It is your choice whether to submit a comment. If you do, you must create a user name, or we will not post your comment. The Federal Trade Commission Act authorizes this information collection for purposes of managing online comments. Comments and user names are part of the Federal Trade Commission’s (FTC) public records system, and user names also are part of the FTC’s computer user records system. We may routinely use these records as described in the FTC’s Privacy Act system notices. For more information on how the FTC handles information that we collect, please read our privacy policy.
The purpose of this blog and its comments section is to inform readers about Federal Trade Commission activity, and share information to help them avoid, report, and recover from fraud, scams, and bad business practices. Your thoughts, ideas, and concerns are welcome, and we encourage comments. But keep in mind, this is a moderated blog. We review all comments before they are posted, and we won’t post comments that don’t comply with our commenting policy. We expect commenters to treat each other and the blog writers with respect.
We don't edit comments to remove objectionable content, so please ensure that your comment contains none of the above. The comments posted on this blog become part of the public domain. To protect your privacy and the privacy of other people, please do not include personal information. Opinions in comments that appear in this blog belong to the individuals who expressed them. They do not belong to or represent views of the Federal Trade Commission.