ISO/IEC 27001:2022 names technical vulnerability management as its own Annex A control — A.8.8. Here's where it sits in the standard's structure, what it actually asks for, and how Vooki Pro's scans and reports give you evidence for it, without claiming to certify anything on their own.
"Start 7-Day Trial" submits a request — Vooki Pro's team reviews it and sends the trial license and installation instructions; it is not an instant self-serve activation.
Sits in the Technological theme of the 2022 revision's 93 Annex A controls (reorganized from the 2013 edition's 114 controls into four themes: Organizational, People, Physical, Technological). The control's aim is identifying exposure to known technical weaknesses and responding to them — commonly described as covering discovery, assessment, prioritization, remediation, and verification.
Like most Annex A controls, A.8.8 states an objective, not an implementation. Your Statement of Applicability and risk treatment plan — the documents your certification auditor actually reviews — define how often you scan and what tooling you use to satisfy it, within your organization's own ISMS.
The ISO/IEC 27001:2022 standard text itself is a paid, licensed document (iso.org) and was not directly reproduced here — this summary is paraphrased from secondary ISO 27001 implementation guides, cross-checked across multiple sources, not quoted verbatim from the standard. Confirm exact wording against the licensed standard for an actual audit.
Scheduled scans provide the ongoing "identification" half of the control for your web applications and REST APIs; the CVSS score and severity on each finding support prioritization; automated retest and the fixed/false-positive triage states provide the remediation-and-verification evidence an auditor would look for in your vulnerability management records.
A.8.8 is one of 93 Annex A controls spanning everything from access control to supplier relationships to physical security. ISO 27001 certification requires a full ISMS audit by an accredited certification body — a DAST tool's output is evidence for one control, not a substitute for the management system or the certification process.
Exporting a scan as an ISO/IEC 27001-mapped report (HTML or PDF, via the Export menu or the CLI's compliance_framework: iso27001 config) gives your ISMS documentation a dated, reproducible artifact for the technical-vulnerability-management control.
See the findings & triage docs · or browse other frameworks
ISO/IEC 27001:2022 (official standard page, iso.org)
Secondary ISO 27001 implementation guides cross-checked for A.8.8's control number and theme (not individually linked — the standard text itself is paywalled, so none of them substitute as a primary source).
Vooki Pro: live features.html, docs/reports.html, docs/cli.html, docs/findings.html (verified 2026-10-23).
No credit card required — submit a request and the team will send your trial license and installation instructions.