ISO/IEC 27001:2022 names technical vulnerability management as its own Annex A control — A.8.8. Here's where it sits in the standard's structure and what it asks for — and what Vooki Pro's report offers today: a legacy mapping to the 2013 edition's Annex A. A 2022-edition control mapping is not currently available.
Sits in the Technological theme of the 2022 revision's 93 Annex A controls (reorganized from the 2013 edition's 114 controls into four themes: Organizational, People, Physical, Technological). The control's aim is identifying exposure to known technical weaknesses and responding to them — commonly described as covering discovery, assessment, prioritization, remediation, and verification.
Like most Annex A controls, A.8.8 states an objective, not an implementation. Your Statement of Applicability and risk treatment plan — the documents your certification auditor actually reviews — define how often you scan and what tooling you use to satisfy it, within your organization's own ISMS.
This is a summary, not the standard's text. ISO/IEC 27001 is a licensed document available from iso.org; use it for exact wording in an audit.
Scheduled scans identify vulnerabilities in your web applications and REST APIs on an ongoing basis; the CVSS score and severity on each finding support prioritization; automated retest and the fixed/false-positive triage states provide the remediation-and-verification evidence an auditor would look for in your vulnerability management records.
Technical vulnerability management is one Annex A control among many (93 in the 2022 edition) spanning everything from access control to supplier relationships to physical security. ISO 27001 certification requires a full ISMS audit by an accredited certification body — a DAST tool's output is evidence for one control, not a substitute for the management system or the certification process.
Exporting a scan as an ISO/IEC 27001 report (HTML or PDF, via the Export menu or the CLI's compliance_framework: iso27001 config) produces a legacy ISO/IEC 27001:2013 mapping: findings are referenced against 2013 Annex A controls such as A.12.6.1. A mapping to the 2022 edition's controls, including A.8.8, is not currently available — so treat the report as dated supporting evidence, not as a mapping to a 2022-based Statement of Applicability.
See the findings & triage docs · or browse other frameworks
ISO/IEC 27001:2022 (official standard page, iso.org)
Vooki Pro documentation: Reports & Compliance · Scan Results & Findings · CLI & CI/CD
Last reviewed 23 October 2026.
No credit card required — submit a trial request; the team reviews it, then sends your trial license and installation instructions.