ISO 27001 certification requires a documented, risk-based vulnerability management process mapped to Annex A control 8.8 — not just a scanner license and a quarterly report. The fastest path in 2026 is tying every scan result to your risk register, defining remediation SLAs by severity, and keeping an audit trail an assessor can trace from finding to fix.
- Align vulnerability management with ISO 27001 by mapping scan output to Annex A control 8.8 and your risk register, not just a scan schedule.
- ISO 27001:2022 cut Annex A to 93 controls but made vulnerability management its own explicit clause, 8.8, instead of folding it into a broader control.
- Auditors in 2026 check for a documented process with evidence it ran on time, not a low vulnerability count.
- Brinqa maps scanner findings to Annex A control language automatically, so audit evidence already exists instead of a manual spreadsheet export.
Why this matters
ISO 27001:2022 restructured Annex A from 114 controls down to 93, organized into four themes: organizational, people, physical, and technological. Vulnerability management now sits explicitly under control 8.8, "Management of technical vulnerabilities," instead of being implied inside a broader patching clause.
That matters because assessors in 2026 test for a specific chain of evidence: identification, risk evaluation, remediation timeline, and verification. A program that runs scans but can't show risk scoring or SLA enforcement fails the control even if the scan reports look clean. The most common finding in ISO 27001 surveillance audits is a vulnerability management process that exists on paper but has no linked evidence in the risk register — aligning vulnerability management with SOC 2 runs into the same gap, since both frameworks want proof the process executed, not just a policy document.
How do you align vulnerability management with ISO 27001?
You align the two by mapping each ISO 27001 clause and Annex A control to a concrete vulnerability management activity, then keeping evidence for each mapping.
| ISO 27001 requirement | What it means for vulnerability management | Evidence an auditor expects |
|---|---|---|
| Annex A 8.8 | Identify, evaluate, and remediate vulnerabilities on owned assets on a defined cadence | Scan logs, ticket timestamps, remediation SLA data |
| Clause 6.1.2 | Vulnerabilities feed the risk register with likelihood and impact scoring | Risk register entries linked to specific CVEs and assets |
| Annex A 5.7 | Severity gets contextualized with active exploitation data, not just CVSS | Threat intelligence source list, exploit-status references |
| Annex A 8.16 | Continuous visibility into new exposures, not point-in-time scans | Monitoring logs, alert history, re-scan cadence |
| Clause 9.2 | The program runs as documented and evidence is sampled | Internal audit findings, corrective action records |
| Annex A 8.9 | Misconfiguration-driven exposure is tracked separate from missing patches | Configuration baseline reports |
Each row is its own piece of evidence. Assessors sample across the table — they will not accept a scan report alone as proof of 8.8, and they will not accept a risk register alone as proof of 6.1.2 without a link back to the underlying finding.
Annex A 8.8: Management of technical vulnerabilities
This is the control most auditors name directly. It requires timely identification of vulnerabilities in the organization's systems, an evaluation of exposure, and remediation within a timeframe the organization itself defined and can show it followed.
The control does not name a required scan frequency or patch window — ISO 27001 leaves that to the organization's own risk appetite, documented in the Statement of Applicability. What it does require is that the timeframe exists in writing and that remediation tickets show it was honored, not just aspired to.
Clause 6.1.2: Risk register integration
A vulnerability without a risk register entry is invisible to an ISO 27001 auditor, no matter how severe the CVSS score. Clause 6.1.2 requires vulnerabilities to be evaluated against likelihood and impact and carried into the formal risk assessment.
Teams that skip this step usually have a scanner and a ticketing system but no bridge between the two. Mapping vulnerabilities to NIST CSF controls forces the same bridge — a finding has to land somewhere in a control framework, not just a dashboard.
Annex A 5.7: Threat intelligence and severity context
ISO 27001:2022 added threat intelligence as its own control because CVSS-only prioritization was producing audit findings of its own — organizations were remediating low-exploitation vulnerabilities while active threats sat unpatched. Control 5.7 expects severity to reflect real-world exploitation signals, not just base score.
Annex A 8.16: Continuous monitoring vs point-in-time scans
A quarterly scan satisfies almost nothing under 8.16. The control expects ongoing monitoring for new exposures as assets, configurations, and code change, with logged evidence the monitoring is continuous rather than scheduled around the audit date.
Why alignment effort varies
The work to align vulnerability management with ISO 27001 depends on a handful of factors specific to the environment:
- Number of scanners and asset types in scope — consolidating findings from multiple tools into one risk register takes more mapping work than a single-scanner environment
- Whether a risk register already exists — building one from scratch during audit prep adds weeks to the timeline
- Maturity of remediation SLAs — defined-but-unenforced SLAs are a common finding on their own
- Cloud vs on-prem asset mix — cloud environments pull in Annex A 5.23 for cloud-specific evidence requirements
- Internal audit cadence — infrequent internal audits leave less time to catch gaps before the external assessor does
- Manual vs consolidated tooling — spreadsheet-based tracking is the single biggest source of missing evidence in surveillance audits
Brinqa's exposure management platform pulls scanner findings, maps them to Annex A control language, and keeps the risk register link intact, so the evidence table above already exists in the platform instead of a manual export before every audit cycle.
See how Brinqa maps to ISO 27001
Consolidate scanner data and audit evidence in one place.
Related questions on ISO 27001 vulnerability management
Is a specific scan frequency required under ISO 27001?
ISO 27001 does not name a fixed scan frequency — the organization defines its own cadence in the Statement of Applicability and Annex A 8.8 evidence has to show that cadence was followed. Auditors flag programs where the documented frequency and the actual scan logs don't match, not the frequency itself.
Does ISO 27001 require a specific vulnerability scanner or tool?
ISO 27001 is tool-agnostic and names no required scanner or platform. What it requires is that whatever tools are in use produce evidence covering identification, risk evaluation, and remediation timing under Annex A 8.8.
How is ISO 27001 different from SOC 2 for vulnerability management?
ISO 27001 ties vulnerability management to a formal risk register under clause 6.1.2, while SOC 2 evaluates the same activity against Trust Services Criteria without a required risk register structure. Programs built for one framework need re-mapping, not a rebuild, to satisfy the other — the control mapping approach is nearly identical either way.
FAQ
What is the main ISO 27001 control for vulnerability management?
Annex A control 8.8, Management of technical vulnerabilities, is the primary control auditors check in 2026. It requires identification, risk evaluation, and timely remediation with evidence of each step.
Does ISO 27001 require a vulnerability risk register?
Yes, clause 6.1.2 requires vulnerabilities to be evaluated for likelihood and impact and carried into the formal risk assessment. A scanner report without a linked risk register entry does not satisfy the clause.
How often should vulnerability scans run for ISO 27001 compliance?
ISO 27001 does not set a fixed frequency; the organization defines its own cadence and must show scan logs matching that documented schedule. Annual-only scanning rarely satisfies Annex A 8.16's continuous monitoring expectation.
What evidence does an ISO 27001 auditor ask for on vulnerability management?
Auditors sample scan logs, remediation ticket timestamps, risk register entries linked to specific CVEs, and internal audit findings tied to Annex A 8.8. A single scan report without linked risk and remediation evidence is treated as incomplete.
Can a manual spreadsheet process pass an ISO 27001 audit?
A spreadsheet process can pass if it consistently links findings to risk scoring and remediation timestamps, but spreadsheets are the most common source of missing or inconsistent evidence in surveillance audits. Consolidated platforms reduce that gap.
Is ISO 27001 vulnerability management the same as patch management?
No, patch management is one remediation path under Annex A 8.8, but the control also covers misconfigurations tracked separately under Annex A 8.9 and risk evaluation under clause 6.1.2. Vulnerability management is the broader process; patching is one output of it.
One last thing
ISO/IEC 27001:2022 cut Annex A from 114 controls in the 2013 version down to 93 — but vulnerability management came out with more explicit attention, not less, when 8.8 became its own standalone control instead of sitting inside a broader operations clause. That's the opposite of what most teams expect from a control consolidation, and it's why vulnerability management evidence gaps are now one of the more common findings in ISO 27001 surveillance audits heading into 2026.
