ISO 27001 Vulnerability and Patch Management: Process, Risk and Audit Evidence

ISO/IEC 27001 expects organizations to manage technical vulnerabilities in a systematic, documented and auditable way. For many security teams, the hardest part is not the patching itself — it is demonstrating to an auditor that vulnerabilities are consistently identified, assessed, treated and recorded. This guide covers the process, the risk decisions and the evidence you need.

What ISO 27001 requires

In ISO/IEC 27001:2022, the relevant Annex A control is A.8.8 — Management of technical vulnerabilities (formerly A.12.6.1 in the 2013 version). In essence, it requires that an organization:

• obtains timely information about technical vulnerabilities in its systems,
• evaluates its exposure to them, and
• takes appropriate measures to address the associated risk.

It connects closely to change management, secure configuration and the overall risk treatment process of your ISMS.

Vulnerability and patch management as a documented process

To satisfy A.8.8, formalize a repeatable process — and write it down:

1. Asset inventory — know what you have.
2. Vulnerability identification — scheduled scanning across network, endpoints, cloud and containers.
3. Assessment & prioritization — rank by real risk (see our prioritization framework).
4. Treatment — patch, mitigate with compensating controls, or formally accept the risk.
5. Verification — confirm closure.
6. Records & review — retain evidence and review at management level.

Patch management is the most common treatment step, but it is only one of the available risk responses — which is the point auditors care about most.

Analyzing each vulnerability: the risk decision

ISO 27001 is risk-based, so each significant vulnerability (or group of vulnerabilities) deserves a decision, not just a patch ticket. Assess it in context — exploitability (EPSS), active exploitation (CISA KEV), asset exposure and business criticality — and then choose one of three treatments:

• Remediate — apply the patch or fix.
• Mitigate — reduce risk with compensating controls (network segmentation, WAF rules, hardened configuration, enhanced monitoring) when an immediate patch is not feasible.
• Accept — formally accept the residual risk when treatment is disproportionate to the risk.

This is the disciplined, risk-based approach the standard expects.

Accept vs mitigate — and doing it properly

Auditors do not expect you to have patched everything. They expect every meaningful unpatched vulnerability to have a conscious, documented decision behind it. A valid risk acceptance is:

• approved by an appropriate risk owner (not the analyst who found it),
• justified (why the risk is acceptable, with the compensating controls in place),
• time-bound, with an expiry or review date — never "accepted forever."

The evidence an ISO 27001 auditor will ask for

This is where most programs struggle. Keep these records current and timestamped:

• The documented procedure itself.
• An asset inventory.
• Scanning records — dates, scope and results over time.
• A risk assessment / treatment record per significant vulnerability or group.
• Risk acceptance approvals — owner, justification, expiry/review date.
• Remediation tickets showing closure (e.g., from Jira or ServiceNow).
• Metrics and management review — SLAs, MTTR, trend over time.

If you can produce these on request, the A.8.8 part of your audit is largely solved.

How priorIQ.ai supports ISO 27001

priorIQ.ai maintains a reconciled asset-and-vulnerability inventory, scores risk per group, lets you record mitigation and risk-acceptance decisions with owners and dates, tracks remediation through Jira/ServiceNow, and exports executive reports — exactly the evidence trail an ISO 27001 auditor expects. Request a demo.

Frequently asked questions

Which ISO 27001 control covers vulnerability management? A.8.8 (Management of technical vulnerabilities) in the 2022 version; A.12.6.1 in the 2013 version.

Do I have to patch every vulnerability for ISO 27001? No. You must assess each one and apply an appropriate treatment — patch, mitigate or formally accept — with documented justification.

What evidence do auditors want? A documented procedure, scanning records, per-vulnerability risk decisions, risk-acceptance approvals, remediation tickets and management-review metrics.