🛡️ Pentest from €539 · Compliance from €89. See All Services →
Optimum Web
Resource · ISO 27001

ISO 27001 Annex A 8.8 — What Evidence Does It Actually Require?

Reviewed: 24 August 2026 — reviewed quarterly

Quick Answer

Annex A 8.8 of ISO/IEC 27001:2022 requires an organisation to obtain information about technical vulnerabilities in its systems, evaluate its exposure, and take appropriate measures. Auditors typically look for a documented process, evidence of testing performed at a defined frequency by a competent party, and records showing what was remediated. A 8.29 is a separate control and requires more.

What Does Annex A.8.8 Actually Say?

Annex A.8.8, "Management of technical vulnerabilities", asks an organisation to do three things on an ongoing basis: obtain timely information about technical vulnerabilities affecting its information systems, evaluate the organisation's exposure to those vulnerabilities, and take appropriate measures to address the risk they present. It is written as a continuous process control, not a one-time test requirement — the standard is asking whether vulnerability management is something your organisation does routinely, not whether you can produce a single report on request.

In practice, an auditor assessing this control is trying to answer three questions: is there a defined process for finding out about vulnerabilities (through scanning, testing, vendor advisories, or a combination); is that process actually followed on a schedule you can describe and justify; and is there a record of what happened after a vulnerability was identified — was it triaged, was it remediated, and how quickly.

What Evidence Do Auditors Accept?

No single document satisfies this control on its own. Auditors are typically looking for a combination of the four items below.

Type of evidenceWhat this looks like in practiceWho produces it
Documented vulnerability management processA written procedure describing how vulnerabilities are identified, triaged and remediated, with an owner and a review cadenceInternal — written by the organisation
Independent testing reportA Vulnerability Assessment or penetration test report covering the in-scope systems, with dated findingsExternal tester or internal security team
Findings register with closure datesA tracked list showing when each finding was identified and when it was closed, not just a point-in-time reportInternal — maintained between test cycles
Evidence of testing cadenceProof that testing happens on a defined, repeated schedule — not a one-off exercise run just before the auditInternal, cross-referenced against test reports

How Is A.8.8 Different From A.8.29?

This is the single most common point of confusion in ISO 27001 audits involving security testing — the two controls sound similar but ask for different depth of evidence.

Annex A.8.8Annex A.8.29
Control nameManagement of technical vulnerabilitiesSecurity testing in development and acceptance
What it's aboutAn ongoing process to identify and remediate vulnerabilities in systems already in operationTesting performed as part of the development and acceptance lifecycle, before and during release
What typically satisfies itRegular vulnerability scanning with manual validation of resultsTesting that most auditors interpret as requiring manual penetration testing
Typical evidenceVulnerability assessment report + findings closure registerPenetration test report + remediation retest
Our matching serviceVulnerability Assessment, €539Focused Pentest, from €1,800

How Often Does "Regular" Mean?

The standard deliberately doesn't set a fixed interval — it leaves the frequency to be justified by the organisation's own risk assessment. In practice, annual testing of externally-facing systems is the most common baseline seen in audits, with more frequent testing (quarterly or after major changes) expected for systems handling higher-risk data or exposed to greater change. The strongest position with an auditor isn't a specific number by itself — it's being able to explain why the interval you chose fits your risk profile, and showing that you actually keep to it.

Where a Vulnerability Assessment Fits — and Where It Doesn't

A vulnerability assessment — automated discovery combined with manual validation of high-severity findings — is a well-matched, cost-effective form of evidence for Annex A.8.8. It directly answers the control's three obligations: it surfaces vulnerability information, the manual validation step evaluates real exposure rather than raw scanner noise, and the report plus findings register documents what measures were taken.

It is not, on its own, sufficient evidence for Annex A.8.29. That control is generally interpreted by auditors as requiring manual exploitation attempts, not automated-plus-validation testing — for that, a penetration test for Annex A.8.29 is the correct evidence to gather.

What Auditors Most Often Flag

Testing performed once, years ago, with nothing since — no evidence of a repeated cadence
No findings register — a report exists but nobody can show what happened to the findings afterward
Testing performed by the same team that built the system, with no independence
A report with no defined scope or dates, making it impossible to confirm what was actually covered and when

Evidence Checklist

A written vulnerability management process with a named owner
A test report dated within the last 12 months for the systems in scope
A findings register showing identification and closure dates
A defined testing cadence you can state and justify to the auditor
Confirmation the tester was independent of the team that built the system
A clear answer for which control — A.8.8 or A.8.29 — the evidence is meant to satisfy

Need evidence that satisfies A.8.8 specifically? Our €539 Vulnerability Assessment includes the report structure this checklist describes — see what a vulnerability assessment report contains and how the accompanying attestation letter is structured for auditors. If your requirement is Annex A.8.29 instead, see our full ISO 27001 readiness assessment.

Start with Vulnerability Assessment

Frequently Asked Questions

Does a vulnerability scan satisfy Annex A.8.8?+
An automated scan alone is a weak answer on its own — auditors generally want to see that findings were reviewed and validated, not just that a scanner ran. A Vulnerability Assessment, which combines automated discovery with manual validation of the high-severity results, is a stronger and more commonly accepted form of evidence than a raw scan output.
Does A.8.8 require an external provider, or can we test ourselves?+
The control doesn't name a specific provider requirement. What matters to most auditors is independence from the team that built or maintains the system being tested, competence of whoever performs the testing, and a documented, repeatable process. An internal security team that is organisationally separate from development can satisfy this; a developer testing their own code typically cannot.
How recent must the testing be at the time of the audit?+
The standard doesn't set a fixed number of months. In practice, most auditors expect evidence from within the last 12 months for the audit period being assessed, and will ask about your stated testing cadence if the most recent evidence is older than that.
Do we need to fix every finding before certification?+
No — auditors look for a functioning remediation process, not a zero-finding report. What matters is that findings are triaged by severity, tracked to closure or a documented risk-acceptance decision, and that Critical/High findings in particular are not left open indefinitely without justification.
Does A.8.8 apply to third-party and cloud components?+
Yes, in principle — the control covers the technical vulnerabilities affecting the organisation's information systems, which includes infrastructure it doesn't fully own. In practice this is usually addressed through a combination of your own external testing and evidence gathered from cloud/SaaS vendors (e.g. their own compliance attestations), rather than testing infrastructure you have no access to directly.
What happens if we have no testing evidence at all?+
It's typically raised as a nonconformity rather than an automatic certification failure, with a corrective action period to produce evidence before the certification decision. Starting a testing programme immediately — even a single Vulnerability Assessment — before the audit is far better than waiting and hoping the gap isn't raised.