Control A.8.8Management of technical vulnerabilities
Information about technical vulnerabilities of information systems in use must be obtained, the organisation’s exposure to such vulnerabilities evaluated, and appropriate measures taken.
Three steps, and organisations usually do the first well and the second badly. Obtaining information is feeds, advisories and scanning. Evaluating exposure is the judgement about what a vulnerability means here — whether the component is present, reachable, and protected by something else. Taking measures is patching, or mitigating, or accepting with a reason.
Prioritisation by severity score alone is the common mistake. A critical score on a component that is not reachable matters less than a moderate one on an internet-facing service, and the threat intelligence from A.5.7 is what supplies the missing input: what is being exploited.
The control also needs an inventory that knows what is installed, which is A.5.9 and A.8.9 doing their work. An organisation that cannot answer “do we run this?” cannot evaluate exposure at all, and will answer the question by scanning and hoping.
How to put this in place
New flaws in software are found all the time, and attackers use known ones. Your ISMS needs a repeatable way to find, rank and fix them, so management can see how exposed you are.
- Set the scope from your asset inventory, including cloud services and container images.
- Decide the scan schedule and the fix deadline for each severity.
- Scan, subscribe to vendor advisories and raise fixes with the owning teams.
- Record any exception with a reason, an owner and an expiry date.
- Report coverage and overdue items to management on a regular cycle.
Evidence an auditor usually looks for: scan coverage against the inventory, remediation times against deadlines, and the exception register.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Mandatory ISMS Documentation ChecklistExcel
Annex A Documents sheet: lists rules for technical vulnerability management, and scan and remediation records among the documents auditors commonly expect for this control.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge.