Key takeaways
- Find and fix technical vulnerabilities in a timely way.
- Unpatched vulnerabilities are an attacker's easiest route in.
- Start here: scan systems and dependencies for vulnerabilities regularly.
Purpose
Find and fix technical vulnerabilities in a timely way.
Requirement
Requirement summaryInformation about technical vulnerabilities of information systems in use shall be obtained, the organization’s exposure to such vulnerabilities should be evaluated and appropriate measures should be taken.
Why it matters
Unpatched vulnerabilities are an attacker's easiest route in.
How to implement
- Scan systems and dependencies for vulnerabilities regularly.
- Rate vulnerabilities by risk and set fix timeframes.
- Patch or mitigate within those timeframes and track exceptions.
- Run penetration tests on key systems.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 8.8. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your vulnerability management process: how often you scan, and how quickly you fix issues by severity.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.8.8 marked as used or not used, a short reason, and its current status.
Records and examples to show
- Recent vulnerability scan reports.
- Examples of high and critical issues showing they were fixed on time.
- Patch status reports for devices and servers.
- Penetration test reports and the fix tracking.
Things you should be able to show or explain
- IT should be able to explain how they decide what to fix first.
How much to show: A handful of serious findings from the last year.
Common mistakes
- Critical issues left open past the deadline.
- Scans that miss some systems.
- Scanning but never fixing.
- No timeframes, so critical issues linger.
- Tip: Define patch timelines by severity.
Policies & documents to have
- Operations Security Policy
- Risk Management Policy
FAQ
Is A.8.8 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.8.8?
Be ready to explain how the control works in your organisation and to provide things like: Your vulnerability management process: how often you scan, and how quickly you fix issues by severity…