ISO 27002:2022
Technological controls – ISO 27002:2022

ISO 27002:2022 8.8: Management of technical vulnerabilities

Requires information about technical vulnerabilities in the information systems in use to be obtained, the organisation's exposure to them to be evaluated, and appropriate measures to be taken. Older source material sets out the surrounding process: named roles and responsibilities, identified information sources, a defined reaction timeline, assessment of the risk posed by the vulnerability against the risk of applying the patch, testing before deployment, alternative measures where no patch exists, an audit log of actions taken, and highest risk systems addressed first.

What else in your programme already covers this

This control maps to 172 controls across 34 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 20 controls

  • 1.2.6 Security features for insecure services defined
  • 11.3.1 Internal vulnerability scans quarterly
  • 11.3.1.1 Address non-high vulnerabilities per TRA
  • 11.3.1.2 Authenticated internal scans
  • 11.3.1.3 Internal scans after significant changes
  • 11.3.2 External vulnerability scans quarterly by ASV
  • 11.3.2.1 External scans after significant change
  • 11.4.1 Penetration testing methodology defined
  • 11.4.3 External penetration testing annually
  • 11.4.4 Pen test findings remediated
  • 12.3.4 Hardware and software technologies reviewed annually
  • 12.6.1 Formal security awareness program implemented
  • 2.2.1 Configuration standards are developed, implemented, and maintained to: • Cover all system components. • Address all known security vulnerabilities. • Be consistent with industry-accepted system hardening standards or vendor hardening recommendations. • Be updated
  • 2.2.5 Insecure services or protocols documented
  • 5.3.2.1 Periodic scan frequency per targeted risk analysis
  • 6.4.1 For public-facing web applications, new threats and vulnerabilities are addressed on an ongoing basis and these applications are protected against known attacks as follows: • Reviewing public-facing web applications via manual or automated application
  • 5.2.3 Any system components that are not at risk for malware are evaluated periodically to include the following: • A documented list of all system components not at risk for malware. • Identification and evaluation
  • 6.3.1 Security vulnerabilities are identified and managed as follows: • New security vulnerabilities are identified using industry-recognized sources for security vulnerability information, including alerts from international and national computer emergency response teams (CERTs). • Vulnerabilities
  • 6.3.2 An inventory of bespoke and custom software, and third-party software components incorporated into bespoke and custom software is maintained to facilitate vulnerability and patch management
  • 6.3.3 All system components are protected from known vulnerabilities by installing applicable security patches/updates as follows: • Patches/updates for critical vulnerabilities (identified according to the risk ranking process at Requirement 6.3.1) are installed within one

CIS Controls v8 · 17 controls

  • CIS-12.1 Ensure Network Infrastructure is Up-to-Date
  • CIS-13.5 Manage Access Control for Remote Assets
  • CIS-14.7 Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates
  • CIS-16.2 Establish and Maintain a Process to Accept and Address Software Vulnerabilities
  • CIS-16.5 Use Up-to-Date and Trusted Third-Party Software Components
  • CIS-16.6 Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities
  • CIS-18.1 Establish and Maintain a Penetration Testing Program
  • CIS-18.2 Perform Periodic External Penetration Tests
  • CIS-18.3 Remediate Penetration Test Findings
  • CIS-2.2 Ensure Authorized Software is Currently Supported
  • CIS-7.1 Establish and Maintain a Vulnerability Management Process
  • CIS-7.2 Establish and Maintain a Remediation Process
  • CIS-7.3 Perform Automated Operating System Patch Management
  • CIS-7.4 Perform Automated Application Patch Management
  • CIS-7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets
  • CIS-7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets
  • CIS-7.7 Remediate Detected Vulnerabilities

FedRAMP High · 12 controls

  • RA-5 Vulnerability Monitoring and Scanning
  • RA-5(11) Vulnerability Monitoring and Scanning | Public Disclosure Program. Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components
  • RA-5(2) Update Vulnerabilities to be Scanned
  • RA-5(3) Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage. Define the breadth and depth of vulnerability scanning coverage
  • RA-5(5) Privileged Access
  • SA-22 Unsupported System Components. a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support
  • SC-7(12) Boundary Protection | Host-based Protection. Implement [Assignment: organization-defined host-based boundary protection mechanisms] at [Assignment: organization-defined system components]
  • SI-2 Flaw Remediation
  • SI-2(2) Automated Flaw Remediation Status
  • SI-2(3) Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective Actions. (a) Measure the time between flaw identification and flaw remediation; and (b) Establish the following benchmarks for taking corrective actions: [Assignment: organization-defined
  • SI-7(1) Integrity Checks
  • SI-8(2) Spam Protection | Automatic Updates. Automatically update spam protection mechanisms [Assignment: organization-defined frequency]

FedRAMP Moderate · 12 controls

  • RA-5 Vulnerability Monitoring and Scanning
  • RA-5(11) Vulnerability Monitoring and Scanning | Public Disclosure Program. Establish a public reporting channel for receiving reports of vulnerabilities in organizational systems and system components
  • RA-5(2) Update Vulnerabilities to be Scanned
  • RA-5(3) Vulnerability Monitoring and Scanning | Breadth and Depth of Coverage. Define the breadth and depth of vulnerability scanning coverage
  • RA-5(5) Privileged Access
  • SA-22 Unsupported System Components. a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support
  • SC-7(12) Boundary Protection | Host-based Protection. Implement [Assignment: organization-defined host-based boundary protection mechanisms] at [Assignment: organization-defined system components]
  • SI-2 Flaw Remediation
  • SI-2(2) Automated Flaw Remediation Status
  • SI-2(3) Flaw Remediation | Time to Remediate Flaws and Benchmarks for Corrective Actions. (a) Measure the time between flaw identification and flaw remediation; and (b) Establish the following benchmarks for taking corrective actions: [Assignment: organization-defined
  • SI-7(1) Integrity Checks
  • SI-8(2) Spam Protection | Automatic Updates. Automatically update spam protection mechanisms [Assignment: organization-defined frequency]

NIST SP 800-53 Rev 5 · 9 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 8 controls

NIST SP 800-218 · 8 controls

AWS Well-Architected Security Pillar · 6 controls

  • SEC01-BP04 Stay up to date with security threats and recommendations
  • SEC06-BP01 Perform vulnerability management
  • SEC06-BP05 Automate compute protection
  • SEC11-BP02 Automate testing throughout the development and release lifecycle
  • SEC11-BP03 Perform regular penetration testing
  • SEC11-BP05 Centralize services for packages and dependencies

Australian Information Security Manual · 5 controls

  • ISM-1143 Patch management processes, and supporting patch management procedures, are developed, imp
  • ISM-1163 Systems have a continuous monitoring plan that includes: - conducting vulnerability scans
  • ISM-1808 A vulnerability scanner with an up-to-date vulnerability database is used for vulnerabilit
  • ISM-1809 When applications, operating systems, network devices or networked IT equipment that are n
  • ISM-1921 The likelihood of system compromise is frequently assessed when working exploits exist for

CMMC 2.0 · 5 controls

HIPAA Security Rule · 5 controls

NIST SP 800-66 Rev 2 · 5 controls

SOC 2 · 5 controls

  • SOC2-CC5.2 COSO principle 11: Selects and develops general controls over technology
  • SOC2-CC6.8 Controls to prevent or detect unauthorized or malicious software
  • SOC2-CC7.1 Detection and monitoring procedures for security events are in place
  • SOC2-CC8.1 Change management processes are in place
  • SOC2-CC9.1 Identifies, selects and develops risk mitigation activities

ACSC Essential Eight · 4 controls

Azure Security Benchmark · 4 controls

  • ASBv3-PV-6 Rapidly and automatically remediate vulnerabilities
  • ASBv3-PV-7 Conduct regular red team operations
  • DS-2 Ensure software supply chain security
  • PV-5 Perform vulnerability assessments

C5 (Germany) · 4 controls

  • C5-OPS-18 Managing Vulnerabilities, Malfunctions and Errors - Concept
  • C5-OPS-19 Managing Vulnerabilities, Malfunctions and Errors - Penetration Tests
  • C5-OPS-22 Testing and Documentation of known Vulnerabilities
  • C5-PSS-03 Online Register of Known Vulnerabilities

NIST Cybersecurity Framework 2.0 · 4 controls

  • NIST-CSF-ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded
  • NIST-CSF-ID.RA-04 Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded
  • NIST-CSF-ID.RA-05 Threats, vulnerabilities, likelihoods, and impacts are used to understand inherent risk and inform risk response prioritization
  • NIST-CSF-PR.PS-02 Software is maintained, replaced, and removed commensurate with risk

UK Cyber Essentials · 4 controls

  • CE-SU.1 Software Licensed and Supported
  • CE-SU.2 Automatic Updates Enabled Where Possible
  • CE-SU.3 Critical and High Updates within 14 Days
  • CE-SU.4 Remove Out-of-Support Software

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 3 controls

  • ANSSI-HYG-34 Define an Update Policy for Information System Components
  • ANSSI-HYG-35 Anticipate the End of Maintenance of Software and Systems
  • ANSSI-HYG-38 Carry Out Regular Security Checks and Audits and Apply the Corrective Actions

DORA · 3 controls

NIS2 Directive · 3 controls

  • Art.21.2.e Security in acquisition, development and maintenance, including vulnerability handling and disclosure
  • Art.21.2.g Basic cyber hygiene practices and cybersecurity training
  • Art.21.4 Take corrective measures without undue delay on finding that the measures are not met

NIST SP 800-161 Rev 1 · 3 controls

NIST SP 800-171 Rev 3 · 3 controls

  • 03.11.02 Vulnerability Monitoring and Scanning
  • 03.14.01 Flaw Remediation
  • 03.14.03 Security Alerts, Advisories, and Directives

NIST SP 800-53 Rev 5 LOW · 3 controls

  • RA-5 Vulnerability Monitoring and Scanning
  • SA-22 Unsupported System Components. a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support
  • SI-2 Flaw Remediation

NIST SP 800-53 Rev 5 MODERATE · 3 controls

  • RA-5 Vulnerability Monitoring and Scanning
  • SA-22 Unsupported System Components. a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support
  • SI-2 Flaw Remediation

NIST SP 800-53 Revision 5.1 HIGH · 3 controls

  • RA-5 Vulnerability Monitoring and Scanning
  • SA-22 Unsupported System Components. a. Replace system components when support for the components is no longer available from the developer, vendor, or manufacturer; or b. Provide the following options for alternative sources for continued support
  • SI-2 Flaw Remediation

APRA CPS 234 · 2 controls

  • CPS234-22 Systematic Control Testing Program
  • CPS234-P17 Active Maintenance of Capability Against Change

ASD Strategies to Mitigate Cyber Security Incidents · 2 controls

  • ASD37-02 Patch applications (Essential)
  • ASD37-19 Patch operating systems (Essential)

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 2 controls

APRA CPS 230 Operational Risk Management · 1 control

  • CPS230-P25 Information and Technology Capability and Asset Health

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-4 Formal vulnerability management program

ISO 27001:2022 · 1 control

  • 8.8 Management of technical vulnerabilities

ISO 27701:2019 · 1 control

  • 6.9.6 Technical vulnerability management

NIST SP 800-172 · 1 control

  • 3.12.1e Penetration Testing by Independent Agents

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Technological controls – ISO 27002:2022

You are reading one control. How much of ISO 27002:2022 have you already done?

ISO 27002:2022 8.8 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO 27002:2022 your existing evidence covers. Hold NIST SP 800-53 Rev 5 and 79 of 93 ISO 27002:2022 controls already carry evidence.

If you hold NIST SP 800-53 Rev 584.9% covered · 14 gapsIf you hold FedRAMP Moderate80.6% covered · 18 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.174.2% covered · 24 gapsIf you hold C5 (Germany)69.9% covered · 28 gapsIf you hold NIST Cybersecurity Framework 2.063.4% covered · 34 gapsIf you hold NIST SP 800-171 Rev 357% covered · 40 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 180 were rejected on the NIST SP 800-53 Rev 5 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 172 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll ISO 27002:2022 controls