ISO 27001 A.8.8: Management of technical vulnerabilities

Build a vulnerability management programme with clear phases: discovery, assessment, prioritisation, remediation, and verification. For discovery: deploy vulnerability scanning tools that cover your entire asset inventory. Scan internet-facing assets at least weekly and internal assets monthly. Run both authenticated and unauthenticated scans. Subscribe to security advisories from every vendor you use. Monitor CVE databases and threat intelligence feeds. For assessment and prioritisation: do not just sort by CVSS score and call it a day. Factor in whether the vulnerability is being actively exploited in the wild, whether the affected system is internet-facing, what data sits on that system, whether you have compensating controls, and how easy it is to exploit. A medium-severity vulnerability on your public-facing API can be more urgent than a critical one on an air-gapped test server. Set remediation SLAs by risk level. A reasonable starting point: critical vulnerabilities (actively exploited, internet-facing) within 24-48 hours, high within 7-14 days, medium within 30 days, low within 90 days. Adjust to fit your operational reality, but make sure the SLAs have teeth. For remediation: patch first, always. When patching is not immediately possible, deploy compensating controls like network segmentation, application-level restrictions, or IPS signatures. Document any accepted risk for vulnerabilities that miss SLA deadlines and get explicit management sign-off. For verification: re-scan after every remediation to confirm the fix actually worked. Track metrics - open vulnerabilities by severity, average time to remediate, patch compliance rates, trends over time. Report these to management regularly. If the numbers are not improving, something in the process is broken. Tie vulnerability management into your other processes. Feed findings into risk assessments. Coordinate patching through change management. Bake vulnerability scanning into your CI/CD pipeline so developers catch issues before production.