ISOISO 27001Annex A Controls OverviewEASYFree question
What does control A.8.8 (Management of technical vulnerabilities) require?
- A.Commissioning annual penetration tests, ranking the findings by CVSS score, and presenting the signed report to the full board of directors
- B.Subscribing to vendor bulletins, mapping each flaw to an asset owner, and removing software that has reached end of support from the approved software catalogue
- C.Maintaining an exploit kit, testing each patch against live attacks, and publishing the results to the wider supplier community and customers
- D.Obtaining information about technical vulnerabilities, evaluating exposure, and taking appropriate measures in a timely manner
Why D is correct
A.8.8 requires timely identification of technical vulnerabilities, exposure evaluation, and appropriate remediation measures.
Know someone studying for ISO 27001? Send them this one.