Identification
Inventory of the external perimeter and controlled scanning, followed by manual verification of the vulnerabilities found. A false positive is documented as such.
ISO/IEC 27001:2022 · Control 8.8 · From €490
ISO 27001 vulnerability assessment: evidence for control 8.8
Annex A control 8.8 requires you to manage technical vulnerabilities: identify them, assess their risk and take corrective action, with evidence. A list of scanner results on its own does not demonstrate that management. Our vulnerability assessment covers the three steps and produces the documents an auditor looks for.
What control 8.8 actually requires
The control does not prescribe a tool, a frequency or a supplier. It requires a process: identify the technical vulnerabilities of the systems in use, assess their exposure and risk, decide and carry out corrective actions, and keep the evidence of all of this.
For this reason a scanner report on its own is not enough: it lacks the assessment, the decision and the verification that the fix happened. Our service concentrates on these steps.
How the service covers each step
Each phase produces a document that can be shown to the auditor without later reconstruction.
Risk assessment
Each confirmed vulnerability is ranked by severity, exploitability, the presence of public exploits and the real exposure of the system, with the reason for its priority.
Corrective action
The remediation plan assigns priorities and suggested owners, with operational guidance for the people who act. It is ready to load into your management system.
Effectiveness check
The free re-verification within 30 days documents which corrective actions closed the vulnerabilities and which remain open.
The evidence an auditor wants to see
An auditor does not look for the number of vulnerabilities. They look for a recognisable process, applied and repeated. The report is built around those questions.
Declared method
Perimeter, methodology (OWASP WSTG and PTES), dates and verification tools are written in the report, so the process can be traced.
Traceable findings
Each vulnerability has reproducible proof, a risk classification and its current status: open, in progress or closed.
Documented decisions
Vulnerabilities excluded from the plan carry the reason. It is one of the most requested pieces of evidence, because it shows that choices were reasoned.
Repeatable cycle
The comparison between one cycle and the previous one shows the trend: proof that the control is continuous rather than a one-off snapshot.
How to use the report in your management system
The report does not replace the information security management system, but it feeds it. A few practices make the link natural.
- Link each vulnerability to an action recorded in your ticketing system, with an owner and a deadline.
- Present the summary at the management review, with the outcomes by priority and the status of the plan.
- Keep the report, the attestation and the re-verification together with the risk assessment, so the link is clear.
- Plan the next cycle based on the risk analysis, not only on the contract date.
When to repeat the verification
The frequency is set by the organisation's risk analysis. These are the moments when a new verification is almost always needed.
After a major release
New features, new integrations or framework changes can introduce surfaces that did not exist before.
After an infrastructure change
A new hosting, a new provider or a new network configuration changes the exposed perimeter.
When a critical vulnerability is published
If a component you use has a published and exploited flaw, the check should be repeated with priority.
Each scheduled cycle
For perimeters that change often we propose a cycle every 4 or 6 months, compared with the previous one.
What this service is not
It is not an ISO/IEC 27001 certification and does not replace the management system, the risk analysis or the audit by the certification body. It does not cover the organisational controls of Annex A, such as policies, training or supplier management, except for what concerns technical vulnerabilities.
How much it costs
The Single perimeter plan costs €490 one-off, VAT excluded, for one primary domain with its subdomains. More domains are quoted on request; Enterprise starts at €4,900. The full price list is on the home page.
Frequently asked questions on ISO 27001 and vulnerability assessment
Does control 8.8 require a penetration test?
The standard does not prescribe a specific tool or test. Many organisations combine scans and documented periodic tests, defined in their own risk analysis.
How often should it be repeated?
It depends on the risk analysis and on how your systems change. For evolving perimeters we recommend periodic cycles, with a comparison between one cycle and the previous one.
Is the report useful with the auditor?
Yes. It documents method, perimeter, findings, priorities, exclusion decisions and the re-verification: the information an auditor asks for to verify the control.
Does the service cover all of Annex A?
No. It covers the technical vulnerabilities of exposed systems, that is control 8.8 and the related technical evidence. Policies, training and supplier management remain in your management system.
How much does it cost?
The single perimeter costs €490 one-off, VAT excluded. For more domains the price is quoted on request.
Need technical proof for control 8.8?
Send us the perimeter: we tell you in writing what is needed and what we would verify.
Request the vulnerability assessment