Vulnerability management for ISO 27001 (Annex A 8.8): a practical approach

A vulnerability is a weakness an attacker could use: an unpatched laptop, an old plugin on your website, a misconfigured cloud storage bucket. Vulnerability management is the routine of finding them, deciding how urgent each is, fixing them in time, and keeping a record.

For a small organisation, most of it comes down to: keep everything updated, know what you're running, and check regularly.

Why it matters

• Annex A 8.8 (management of technical vulnerabilities) in ISO/IEC 27001:2022 asks you to get information about vulnerabilities in the systems you use, assess your exposure, and take appropriate action.
• Annex A 8.9 (configuration management) and 8.19 (installation of software on operational systems) support it.
• Cyber Essentials requires high-risk and critical security updates to be applied within 14 days of release, and unsupported software to be removed.

A simple routine

1. Know what you have. Your asset register and device management tool tell you what needs patching.
2. Turn on automatic updates wherever you can: operating systems, browsers, office software.
3. Watch for the rest. Check vendor advisories for your key systems, and run a vulnerability scan of internet-facing systems on a schedule.
4. Set fix timescales by severity, for example critical and high within 14 days, medium within 30, low at the next scheduled update.
5. Record what you found and what you did, including anything you've accepted.

What an auditor looks for

• A defined process with timescales by severity.
• Evidence it runs: scan reports, patch reports, records of fixes.
• Timescales are met, or late fixes are explained and risk-accepted.
• Unsupported systems are identified and either removed or managed as exceptions.

Common reasons it fails: no records; scans run but findings never fixed; or an old server nobody remembered.

Common mistakes, and how to keep it manageable

• Tracking every patch by hand. Let your device management tool do the patching and reporting; record exceptions and the serious findings.
• Scanning without acting. A report nobody reads is worse than none, because it proves you knew.
• Forgetting web apps and SaaS settings. Vulnerabilities aren't only missing patches.

How to do it in ClearIMS

1. Open Vulnerabilities and record each significant finding: what's affected, how severe, the owner and the fix date.
2. Track the fix as an action with an owner and due date, so ClearIMS emails the owner when it's due.
3. Record accepted risks as exceptions where you can't fix in time.
4. Show it at audit. Vulnerability records are included in the auditor portal pack.

Related pages

• Cyber Essentials: the 14-day update rule.
• Assets: what you need to keep patched.
• Threat intelligence: where new vulnerabilities come to light.
• Change records: recording significant fixes and changes.