The organization employs automated mechanisms [Assignment: organization-defined frequency] to determine the state of information system components with regard to flaw remediation.
Continuously with HBSS 30 days for any additional internal network scans not covered by HBSS Annually for external scans by (Computer Network Defense Service Provider) CNDSP
Source:
DoD RMF TAG