ISO/IEC 27001:2022 · Technological control
ISO 27001 Annex A 8.8: Management of technical vulnerabilities
Quick answer
ISO 27001 Annex A 8.8 (Management of technical vulnerabilities) is a technological control. Find, assess and fix technical vulnerabilities in a timely way.
What auditors look for
Auditors check that 8.8 is either justified as not applicable in your Statement of Applicability or implemented and working. Typical evidence includes:
- Vulnerability scan reports
- Patch timelines by severity
- Exception records for unpatched systems
How to implement 8.8 in practice
- Prioritise with CISA KEV, CVSS and EPSS
- Set patch deadlines by severity
- Track exceptions in the risk register
- Name an owner for 8.8, decide how often it runs and file evidence each time, so the control is audit-ready all year.
Recording 8.8 in the Statement of Applicability
List 8.8 with whether it applies, the reason (usually the risks it treats or a legal or contractual requirement), its implementation status and where the evidence lives. If you exclude it, explain why none of your risks or obligations require it.