What it asks for. This control expects the organisation to obtain timely information about technical vulnerabilities in the systems it uses, evaluate its exposure and take appropriate action. It covers both finding weaknesses and deciding how to deal with them.
In practice. Good practice combines an accurate asset inventory, regular vulnerability scanning, vendor advisories and threat intelligence to identify relevant weaknesses. Each finding is prioritised by severity, exploitability and asset criticality, then remediated within defined timeframes or covered by a documented exception with compensating measures. Auditors typically look for scan reports, remediation tracking, service level targets and evidence that exceptions are reviewed.
Common gaps. Frequent gaps are scanning that excludes cloud, OT or third-party hosted assets, no prioritisation beyond severity scores, and exceptions that are never revisited.