Annex A 8.8 - Management of Technical Vulnerabilities

Information about technical vulnerabilities of information systems in use shall be obtained, the organization’s exposure to such vulnerabilities shall be evaluated, and appropriate measures shall be taken.