A.8.8 Technological
Management of technical vulnerabilities
Structured attributes from ISO/IEC 27002:2022 — control type · CIA properties · cybersecurity concept · operational capability · security domain. What do these mean?
Mapped NIST 800-53 r5 controls (12)
Our AI-authored reading (authority llm_unverified, under review) of how this ISO control and each NIST 800-53 control relate. Not an ISO or NIST product.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- RA-5mostlyaligns with — Both controls establish systematic processes for discovering, analyzing, and responding to technical vulnerabilities across organizational assets.
- SI-2mostlyaligns with — Both controls require timely remediation of identified flaws through patching and configuration updates supported by testing and documentation.
- CA-8partialaligns with — Both controls authorize the use of penetration testing and vulnerability assessments by competent personnel to uncover security weaknesses.
- CM-8partialaligns with — Both controls rely on an accurate, up-to-date system component inventory as the foundation for effective vulnerability identification and tracking.
- SA-11partialaligns with — Both controls require suppliers and developers to identify, report, and remediate vulnerabilities in delivered products and components.
- SR-3partialaligns with — Both controls embed vulnerability disclosure and handling requirements into supplier relationships and contractual obligations.
Aligned NIST CSF 2.0 outcomes (13)
NIST CSF 2.0 outcomes this ISO control aligns with — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- ID.RA-01mostlyaligns with — The ISO control's requirement to maintain an asset inventory and use scanning plus penetration testing to discover and record vulnerabilities directly supports the CSF outcome of identifying, validating, and recording asset vulnerabilities.
- ID.RA-08mostlyaligns with — Establishing a public disclosure point, vulnerability reporting procedures, and participation in threat-intelligence forums fulfills the CSF outcome of having defined processes for receiving, analyzing, and responding to vulnerability disclosures.
- ID.RA-02partialaligns with — The ISO control's use of external information resources, threat intelligence, and information-sharing forums to stay aware of vulnerabilities aligns with the CSF outcome of receiving cyber threat intelligence from external sources.
- ID.RA-05partialaligns with — Evaluating identified vulnerabilities to determine associated risks and required actions mirrors the CSF outcome of using threats, vulnerabilities, likelihoods, and impacts to understand inherent risk and prioritize responses.
- ID.RA-06partialaligns with — The ISO control's guidance to select and implement remediation actions such as patching or other controls corresponds to the CSF outcome of choosing, prioritizing, planning, tracking, and communicating risk responses.
- PR.PS-02partialaligns with — Implementing a software-update management process to install approved patches and updates aligns with the CSF outcome of maintaining, replacing, or removing software commensurate with risk.
Related OWASP ASVS 5.0 requirements (10)
Application-security verification requirements (OWASP ASVS 5.0) this ISO control aligns with; links open the ASVS chapter. Our AI-authored analysis (authority llm_unverified, under review) — many ISO controls have no ASVS counterpart.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- V15.1.2mostlyaligns with — Maintaining an accurate asset inventory that records software vendors, names, versions, and deployment state directly supports the requirement to keep an up-to-date inventory catalog of all third-party libraries and their versions.
- V15.1.1partialaligns with — Defining roles, responsibilities, and procedures for vulnerability monitoring, risk assessment, and remediation establishes the risk-based remediation time frames for vulnerable third-party component versions.
- V15.2.1partialaligns with — Requiring timely patching and remediation of identified vulnerabilities ensures that components do not remain in breach of the documented update and remediation time frames.
- V15.2.4partialaligns with — Tracking third-party libraries and source code for vulnerabilities and verifying that components come from expected repositories aligns with the need to ensure third-party components and transitive dependencies are obtained from trusted sources.
- V15.2.5partialaligns with — Using vulnerability scanning, penetration testing, and bug-bounty programs to identify and remediate issues provides additional protections around parts of the application that contain risky or vulnerable components.
Related weaknesses / CWE (20)
Weakness classes this ISO control helps prevent or mitigate — our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- CWE-1104mostlyfinds — A maintained asset inventory plus scheduled scanning and patching directly reduces the window during which known vulnerable third-party components remain exploitable.
- CWE-1342mostlyfinds — Vulnerability management includes tracking and applying microcode/firmware fixes that mitigate transient-execution side-channels.
- CWE-1357mostlyfinds — Vulnerability management can detect issues stemming from insufficiently trusted components.
- CWE-611mostlyfinds — Vulnerability management identifies and patches XML libraries with unsafe default entity settings.
- CWE-652mostlyfinds — Vulnerability management processes identify and remediate XQuery injection flaws in production.
- CWE-1329partialfinds — Vulnerability-management processes can detect and drive replacement of non-updateable components, but cannot retroactively make them patchable.
- CWE-284partialfinds — Vulnerability scans and penetration tests routinely detect missing or misconfigured access-control mechanisms, prompting timely remediation.
- CWE-502partialfinds — Regular scanning of third-party libraries and timely patching reduce the likelihood that unsafe deserialization vulnerabilities remain active.
- CWE-643partialfinds — Vulnerability management processes identify and remediate XPath injection flaws discovered post-deployment.
- CWE-69partialfinds — Vulnerability-management processes can identify and patch OS or application weaknesses that permit ADS abuse, but do not directly address improper ADS handling in custom code.
- CWE-1039nonenone — Vulnerability management may identify adversarial ML weaknesses but does not directly prevent them.
- CWE-1310nonedetects — Vulnerability management explicitly requires timely patching of firmware/ROM, directly addressing the inability to patch ROM code.
- CWE-20nonenone — Penetration testing and vulnerability assessments surface missing or inadequate input-validation flaws before they can be exploited in production.
- CWE-477nonenone — Vulnerability management may flag deprecated functions as known weaknesses during scans.
- CWE-494nonenone — Requiring suppliers to disclose vulnerabilities and mandating verified updates lowers the chance that code lacking integrity checks will be deployed.
- CWE-509nonemitigates — Vulnerability management indirectly lowers exploit paths used by replicating malware.
Mitigated MITRE ATT&CK techniques (7)
Adversary techniques (MITRE ATT&CK Enterprise) this ISO control helps mitigate; links open attack.mitre.org. Our AI-authored analysis (authority llm_unverified, under review).
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial). gov = governs / implements (a mandate, not coverage).
Why these map — AI rationale (under review)
- T1068mostlydetects — Systematic identification and remediation of software flaws limits the pool of unpatched vulnerabilities that can be abused to escalate privileges on a compromised host.
- T1190mostlydetects — Regular vulnerability scanning and timely patching of public-facing systems directly reduces the number of exploitable weaknesses an attacker can leverage to gain initial access.
- T1203mostlydetects — Fewer unpatched client-side vulnerabilities mean attackers have reduced success when attempting to exploit user applications via malicious documents or web content.
- T1210mostlyprevents — By maintaining an asset inventory and applying patches to discovered vulnerabilities, the control shrinks the attack surface that adversaries scan for when attempting to exploit remote services for lateral movement.
- T1059partialmitigates — Patching scripting interpreters and related runtimes removes many of the known flaws that adversaries rely on when executing arbitrary commands through interpreters.
- T1505partialmitigates — Routine scanning and patching of server software components such as web shells or stored procedures prevents adversaries from installing or maintaining persistent server-side implants.
- T1559partialdetects — Addressing vulnerabilities in inter-process communication mechanisms reduces opportunities for attackers to abuse COM, DDE, or similar channels to execute code.
Control IDs, short titles and the structured attribute table (control type, CIA properties, cybersecurity-concept, operational capability, security domain) are facts from ISO/IEC 27001:2022 Annex A / ISO/IEC 27002:2022. The full implementation guidance prose lives in ISO/IEC 27002:2022 — not reproduced here. Cross-walks to NIST 800-53, NIST CSF 2.0, OWASP ASVS, CWE, MITRE ATT&CK and OWASP Web Top 10 are our own AI-authored analysis (authority llm_unverified, under review), not an ISO, NIST, MITRE or OWASP product — how ours compare.