A.8.8 Management of technical vulnerabilities
Obtain vulnerability information, evaluate exposure, and take appropriate remediation.
12
artefacts
4
held by a system
3
at each review
moderate
to go live
Vulnerability scanner / patch tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Logs from internal vulnerability scanning tool showing detected findings · Vulnerability scanner / patch tooling
- Ticketing system export showing assignment, work notes, and closure dates for vulnerability tickets · Vulnerability scanner / patch tooling
- Change request forms linked to each vulnerability remediation ticket · Vulnerability scanner / patch tooling
- Deployment logs from endpoint management system for the last patch cycle · Vulnerability scanner / patch tooling
periodic reviewEvidence produced at each review
- Executive summary of the latest vulnerability exposure assessment · Vulnerability scanner / patch tooling
- Verification test results confirming successful remediation · Ticketing / ITSM
- Signed off report confirming completion of the patch rollout · Vulnerability scanner / patch tooling
governing documentDocuments that govern the control
- Subscription confirmation email from vulnerability feed provider · Policy repository / GRC workspace
- Exported CSV of aggregated vulnerability feed for the past quarter · Policy repository / GRC workspace
- Matrix assigning risk scores to identified CVEs · Policy repository / GRC workspace
- Business impact analysis document for high‑severity vulnerabilities · Policy repository / GRC workspace
- Approved patch management schedule covering critical systems · Policy repository / GRC workspace
First move
Start with the 4 of 12 artefacts that already live in a system (Vulnerability scanner / patch tooling); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Relying on ad-hoc scans only
- Missing documented risk ranking for vulnerabilities
- No evidence of timely remediation verification
- Failure to retain proof of feed subscription
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetA.8.7 Protection against malware · A.8.9 Configuration management