Free vulnerability scanning for your business

You know the importance of strong cybersecurity, but have you heard about free vulnerability testing? As part of its mission to protect the nation’s cyber infrastructure, the Department of Homeland Security’s Cyber-Infrastructure Security Agency (CISA) offers free vulnerability scanning to government, critical infrastructure, and private businesses.

What does this mean for you? You may be eligible for no-cost vulnerability scanning that will continuously check your internet-facing assets. The testing checks for known vulnerabilities and weak configuration, then recommends ways to improve your security. Using commercial vulnerability scanners, each host is evaluated against a library of vulnerabilities.

How does it work? To get started, contact CISA at NCATS_INFO@hq.dhs.gov. Next, they’ll send you documents to return and sign, confirm a scanning schedule, and send you a pre-scan notification. After CISA processes your request, they’ll start scanning for vulnerabilities within 72 hours. Once it’s set up, the service is automated and requires very little direct interaction. Within two weeks, you’ll start getting weekly summary reports, with vulnerability mitigation recommendations.

Still not sure it’s right for your business? CISA has created a Cyber Hygiene Sample Report so you can see what to expect. The report identifies the number of vulnerable hosts and ranks vulnerabilities by severity (critical, high, medium, low) to help you prioritize remediation efforts. When you get the report, it’s up to you to take the steps to address any issues it identified. The report also shows changes since your previous report, including a list of vulnerabilities that you’ve mitigated.

Worried about who else is going to find out about your company’s vulnerabilities? Your password-protected Cyber Hygiene Report gets delivered to a single address within your company. CISA says that they will not share information that’s attributable to a specific company, without your company’s written consent. They use anonymized data to develop reports for trending and analysis.

These vulnerability scans offer one more tool in your company’s cybersecurity toolbox. For more tips and tools, check out the FTC’s Cybersecurity for Small Business and Start with Security materials.