ISO 27001 technical vulnerability management
ISO 27001 control A.8.8 asks you to obtain information about technical vulnerabilities, evaluate exposure and take action, with records to show it happened. CVEasy AI does the finding, prioritizing and validating, and leaves behind a tamper-evident record, all on your own hardware.
A.8.8 · Evidence · On-box
A.8.8 is about knowing, judging and acting, with a record.
The control is a loop, not a one-off scan.
ISO 27001:2022 control A.8.8, management of technical vulnerabilities, expects you to obtain timely information about vulnerabilities in the systems you use, evaluate your exposure, and take appropriate measures. Annex A also expects the activity to be recorded so an auditor can see the loop running.
As with SOC 2, scanning is rarely the bottleneck. The work is evaluating exposure in context and keeping a credible record, ideally without shipping sensitive findings off the machine.
The A.8.8 loop, with evidence built in.
Each step of the control maps to something CVEasy already does.
- Obtain information: 328,000+ CVEs synced daily from NVD, enriched with OSV, GHSA, CISA KEV and EPSS
- Evaluate exposure: TRIS™ 3 scoring weighs exploitability, asset context, business impact and reachability in your environment
- Confirm reachability: built-in attack simulation records what is actually exploitable, so effort goes where it counts
- Take action: on-box AI remediation generates prioritized, step-by-step fixes per finding
- Keep the record: an append-only, signed, hash-chained ledger with a dependency-free offline verifier
- Residency: findings and the AI stay on your Apple Silicon Mac, air-gap capable
A self-mapping, not a certificate.
We say where we are, not where we wish we were.
CVEasy ships a live Security & Audit posture that maps its own controls to ISO 27001, SOC 2 and NIST CSF, each marked active, attested or degraded. Our own ISO 27001 and ISO 42001 Statements of Applicability are drafted as internal documents. CVEasy is not ISO 27001 certified, and we present this as a self-mapping, never as a certificate we hold.
For an A.8.8 review, the signed, hash-chained ledger plus the offline verifier is the part that is hard to fake: it demonstrates the activity ran and the record is intact. The written policy set, the statements of applicability for ISO/IEC 27001 and 42001, and the CAIQ-lite / SIG-lite sheet are available under NDA: request the security pack. See the Trust Center for the public summary.
Questions, answered.
The questions practitioners actually ask.
Is CVEasy ISO 27001 certified?
No. CVEasy is not ISO 27001 certified. Our ISO 27001 and ISO 42001 Statements of Applicability are drafted as internal documents. CVEasy supports your A.8.8 technical vulnerability management and maps its own controls to ISO 27001 as a self-assessment, never as a certificate we hold.
How does CVEasy map to control A.8.8?
It covers the whole loop: obtain vulnerability information (328,000+ CVEs synced daily with KEV and EPSS enrichment), evaluate exposure (TRIS™ contextual scoring), confirm reachability (attack simulation), take action (on-box AI remediation), and keep a tamper-evident record (signed, hash-chained ledger).
What record can I show an auditor?
An append-only, Ed25519-signed, SHA-256 hash-chained ledger of actions, verifiable with a dependency-free offline checker, alongside TRIS™ risk-ranking and validation results.
Do findings leave my environment?
No. Findings, asset inventory and the AI stay on your own Mac, which is air-gap capable. Only minimal licensing data touches the vendor side; see the subprocessor list in the Trust Center.
Run the A.8.8 loop with evidence built in.
Find, judge, act and record, on your own hardware.
Mac-native · local-first · your data never leaves the box