Networked-device vulnerability scans (e.g., Nessus) must be performed and remediated at least twice a year.