What federal law requires the use of vulnerability scanning on information systems operated by federal...

The Federal Information Security Modernization Act (FISMA) requires federal agencies to implement comprehensive information security programs, including continuous monitoring and vulnerability scanning.

FISMA mandates risk-based security controls aligned with NIST standards, such as NIST SP 800-53 and NIST SP 800-137.

HIPAA applies to healthcare data, GLBA applies to financial institutions, and FERPA protects student education records. None of these broadly mandate vulnerability scanning across federal systems.

FISMA is foundational to federal cybersecurity governance and compliance.