Short answer
ISO 27001 Annex A control 8.8, Management of technical vulnerabilities, requires you to obtain information about technical vulnerabilities in the information systems you use, evaluate your exposure, and take appropriate measures. In practice that means an asset inventory, regular scanning and vendor advisories, risk-based remediation timeframes, and tracked exceptions.
Key takeaways
- You need to know what you run before you can find its vulnerabilities.
- Rank by risk: severity, exploitation in the wild and exposure.
- Set remediation timeframes and measure against them.
- Exceptions need an owner, a reason and a review date.
What the control says
A.8.8 requires that information about technical vulnerabilities of information systems in use is obtained, your exposure to them is evaluated, and appropriate measures are taken. ISO/IEC 27002 guidance covers maintaining an inventory of assets and software, defining roles, using vendor and other sources of vulnerability information, assessing risk, testing patches, and applying other measures when no patch is available.
A workable process
- Keep an inventory of systems, software and versions in scope ().
- Collect vulnerability information: authenticated scans, cloud posture tools, vendor advisories.
- Prioritise using severity, whether the flaw is known to be exploited, and how exposed the system is.
- Fix within your defined timeframe, or apply a compensating measure.
- Verify the fix with a rescan and close the ticket.
- Record exceptions with owner, reason, compensating controls and expiry.
Setting remediation timeframes
| Priority | Example criteria | Example timeframe |
|---|---|---|
| Critical | Known exploited, or critical severity on an internet-facing system | Days |
| High | High severity on exposed or sensitive systems | 2–4 weeks |
| Medium | Medium severity, or high on internal systems with other protections | 1–3 months |
| Low | Low severity | Next maintenance cycle |
These timeframes are examples. Set your own in policy, based on risk, and report how often you meet them. CISA's Known Exploited Vulnerabilities catalogue is a useful signal for what to fix first.
Evidence auditors sample
- Scan schedules and recent scan reports covering the scope
- A sample of findings traced to tickets and fix dates
- Performance against your remediation timeframes
- Approved exceptions with expiry dates
- Asset inventory reconciled with what the scanner sees
A.8.8Technical vulnerabilitiesSOC 2 CC7.1Detecting vulnerabilitiesA.8.8Technical vulnerabilitiesNIST CSF ID.RA-01Vulnerabilities identifiedA.8.8Technical vulnerabilitiesPCI DSS 6.3 · 11.3Patching and scanning
Put this into practice on QULDEX
Frequently asked questions
Does ISO 27001 set patching deadlines?
No. You set remediation timeframes based on risk in your own policy, then show you meet them.
Is penetration testing required for A.8.8?
Not specifically. A.8.8 needs vulnerability information and action; penetration tests are one useful source, and A.8.29 covers security testing in development.