[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-8-8":3},{"item":4,"lessons":16,"controls":67,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-8-8","Annex A 8.8","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities",240,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects the organisation to obtain timely information about technical vulnerabilities in the systems it uses, evaluate its exposure and take appropriate action. It covers both finding weaknesses and deciding how to deal with them.\n\n**In practice.** Good practice combines an accurate asset inventory, regular vulnerability scanning, vendor advisories and threat intelligence to identify relevant weaknesses. Each finding is prioritised by severity, exploitability and asset criticality, then remediated within defined timeframes or covered by a documented exception with compensating measures. Auditors typically look for scan reports, remediation tracking, service level targets and evidence that exceptions are reviewed.\n\n**Common gaps.** Frequent gaps are scanning that excludes cloud, OT or third-party hosted assets, no prioritisation beyond severity scores, and exceptions that are never revisited.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},242,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"greek-authority-fined-for-unlawful-publication-of-personal-data-on-transparency-portal","Greek Authority Fined for Unlawful Publication of Personal Data on Transparency Portal","2026-10-18T20:20:25.794+00:00",{"slug":24,"title":25,"published_at":26},"siteguard-waf-os-command-injection-exploited-for-root-access","SiteGuard WAF OS Command Injection Exploited for Root Access","2026-10-18T16:20:26.047+00:00",{"slug":28,"title":29,"published_at":30},"vodafone-spain-fined-400k-after-ignoring-known-vulnerability-for-months","Vodafone Spain Fined €400K After Ignoring Known Vulnerability for Months","2026-10-16T12:20:31.802+00:00",{"slug":32,"title":33,"published_at":34},"actively-exploited-atlassian-vulnerability-added-to-cisa-kev-catalog","Actively Exploited Atlassian Vulnerability Added to CISA KEV Catalog","2026-10-15T20:21:37.943+00:00",{"slug":36,"title":37,"published_at":38},"unpatched-routers-hijacked-to-silently-sell-your-bandwidth","Unpatched Routers Hijacked to Silently Sell Your Bandwidth","2026-10-15T20:21:08.002+00:00",{"slug":40,"title":41,"published_at":42},"incomplete-patches-leave-backup-software-open-to-active-exploitation","Incomplete Patches Leave Backup Software Open to Active Exploitation","2026-10-15T10:21:36.587+00:00",{"slug":44,"title":45,"published_at":46},"cisa-flags-four-actively-exploited-vulnerabilities-requiring-immediate-patching","CISA Flags Four Actively Exploited Vulnerabilities Requiring Immediate Patching","2026-10-14T22:21:22.354+00:00",{"slug":48,"title":49,"published_at":50},"critical-sap-netweaver-s4hana-flaws-demand-immediate-patching","Critical SAP NetWeaver & S\u002F4HANA Flaws Demand Immediate Patching","2026-10-14T08:21:14.039+00:00",{"slug":52,"title":53,"published_at":54},"record-1413-microsoft-vulnerabilities-patched-including-actively-exploited-zero-day","Record 1,413 Microsoft Vulnerabilities Patched, Including Actively Exploited Zero-Day","2026-10-14T08:20:44.178+00:00",{"slug":56,"title":57,"published_at":58},"record-october-patch-tuesday-exposes-zero-day-risk-for-slow-patchers","Record October Patch Tuesday Exposes Zero-Day Risk for Slow Patchers","2026-10-14T00:21:19.32+00:00",{"slug":60,"title":61,"published_at":62},"microsofts-record-1400-patch-release-strains-security-teams","Microsoft's Record 1,400+ Patch Release Strains Security Teams","2026-10-14T00:20:18.008+00:00",{"slug":64,"title":65,"published_at":66},"windows-10-extended-security-update-addresses-record-1411-vulnerabilities-including-actively-exploit","Windows 10 Extended Security Update Addresses Record 1,411 Vulnerabilities Including Actively Exploited Zero-Day","2026-10-13T20:20:33.411+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"patch-management","Automated patch management","Known holes get closed in days, not months.",200,{"slug":74,"name":75,"problem":76,"stories":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",183,{"slug":79,"name":80,"problem":81,"stories":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",52,{"slug":84,"name":85,"problem":86,"stories":87},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",38,{"slug":89,"name":90,"problem":91,"stories":92},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",18,{"slug":94,"name":95,"problem":96,"stories":92},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[98,104,110,114,120,125,130,135],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","7","Control 7","Continuous Vulnerability Management",236,{"family":105,"item":106,"code":107,"title":108,"together":109},"nist-800-53","si-2","SI-2","Flaw Remediation",180,{"family":111,"item":112,"code":113,"title":113,"together":109},"itil","overview","ITIL",{"family":115,"item":116,"code":117,"title":118,"together":119},"nist-sp","800-40","SP 800-40","SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology",168,{"family":99,"item":121,"code":122,"title":123,"together":124},"12","Control 12","Network Infrastructure Management",128,{"family":105,"item":126,"code":127,"title":128,"together":129},"ra-5","RA-5","Vulnerability Monitoring and Scanning",127,{"family":99,"item":131,"code":132,"title":133,"together":134},"2","Control 2","Inventory and Control of Software Assets",83,{"family":136,"item":137,"code":138,"title":139,"together":140},"gdpr","32","Article 32","Security of processing",77]