CONTROLLED UNCLASSIFIED INFORMATION (CUI) - FOR TRAINING PURPOSES ONLY

Annual Vulnerability Scan Summary Report (CY2024)

CMMC 2.0 Level 2 Compliance

Organization Information
Organization:
ACME Technology Services Corporation
Prepared by:
IT Security Team / CISO
Date:
January 15, 2025
Classification:
Controlled Unclassified Information (CUI)
Executive Summary

This report summarizes the findings from ACME's quarterly internal and external vulnerability scans conducted throughout calendar year 2024. These scans were performed using industry-recognized tools (e.g., Nessus, OpenVAS, Qualys) and focused on identifying vulnerabilities across the organization's systems, networks, endpoints, and cloud environments.

A total of four enterprise-wide scans and twelve targeted scans were conducted. The findings are consistent with national trends affecting small and medium-sized businesses (SMBs) and emphasize the importance of continuous patching, secure configurations, and user awareness.

Key Metrics
124
Total Systems Scanned
279
Unique Vulnerabilities Detected
17
Critical Vulnerabilities (6.1%)
56
High-Risk Vulnerabilities (20.1%)
91%
Vulnerabilities Remediated
9 days
Avg Time to Remediate (Critical)
Top 5 Vulnerability Categories
Category % of Total Findings Common CVEs Identified Actions
Outdated Software / Unpatched OS 26% CVE-2023-21674, CVE-2024-0179
Misconfigured Web Servers 21% CVE-2024-23897 (Apache), CVE-2024-0347
Weak TLS/SSL Configurations 16% Use of deprecated ciphers, TLS 1.0/1.1
Missing Endpoint Protection Updates 13% AV signature failures, disabled agents
Default Credentials / Open Ports 11% SSH/FTP open to public, weak password use
Notable Findings
Trends Across SMBs in 2024

ACME's vulnerability posture mirrors national patterns seen in other small and mid-sized contractors in 2024, notably:

  1. Legacy System Exposure: Many SMBs rely on aging infrastructure without long-term vendor support.
  2. Patch Management Gaps: Delays in patching due to resource constraints or fear of operational disruption.
  3. Remote Work Risks: Increased use of VPNs and remote access tools without consistent hardening.
  4. Cloud Misconfigurations: Poor IAM policies and logging gaps in cloud platforms (e.g., Azure, AWS).
  5. Social Engineering Threats: Exploitation of untrained personnel through phishing and MFA bypass attacks.
CMMC 2.0 Level 2 Compliance Status
Asset Inventory 100% Complete
Vulnerability Scanning Implemented
Risk Assessment (RA.L2-3.11.1) Compliant
Vulnerability Remediation (RA.L2-3.11.3) 91% Complete
FIPS 140-2 Encryption Validated
Access Controls Implemented

🎯 CMMC Level 2 Recommendations

  1. Enhance Patch Management Processes – Reduce critical vulnerability resolution time to <7 days.
  2. Expand Use of MFA – Apply multi-factor authentication to all administrative and VPN access.
  3. Network Segmentation – Further isolate legacy systems and OT devices from production networks.
  4. User Training & Phishing Simulations – Improve resilience against credential-harvesting campaigns.
  5. Quarterly Vulnerability Scans + Monthly Delta Scans – Implement continuous assessment model.
Conclusion

ACME Technology Services Corporation has made measurable improvements in reducing its vulnerability surface in 2024. Continued commitment to cybersecurity hygiene and alignment with CMMC 2.0 Level 2 practices will help ensure resilience against emerging threats in 2025 and beyond.

This report demonstrates compliance with NIST SP 800-171 requirement RA.L2-3.11.2 (Vulnerability Scanning) and supports the organization's broader CMMC Level 2 certification efforts.

Prepared by: Raymond Lawrence, Chief Information Security Officer

Review Date: June 15, 2025

Document Classification: Controlled Unclassified Information (CUI)

This is a training simulation for CMMC 2.0 Level 2 compliance education.