Vulnerability Remediation Tracker Template (ISO/IEC 27001 A.8.8)

Vulnerability Remediation Tracker: [Organization name] [Period]

Working register for every vulnerability finding from discovery to verified closure: priority inputs (CVSS v4.0, EPSS, CISA KEV), the remediation due date from the service level, owner, status, exceptions and the metrics that show whether remediation keeps pace. It supports ISO/IEC 27001:2022 + Amd 1:2024 Annex A control A.8.8 (technical vulnerability management) with guidance from ISO/IEC 27002:2022, and records the operation of the vulnerability management policy (security/vulnerability-management-policy). Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

1. Purpose and use
2. Service levels
3. Tracker fields
4. Tracker register
5. Finding lifecycle
6. Exceptions
7. Metrics
8. Size tiers
9. Records and evidence
10. References
11. Standard and licence note

1. Purpose and use

The tracker holds every vulnerability finding in scope of the ISMS (DOC-ISMS-002) that needs action: scanner results for infrastructure, cloud and containers, application security test results, penetration test findings (security/pentest-report), supplier security advisories, and reports from researchers. Findings are grouped by asset as recorded in the asset inventory (DOC-ISMS-012), so each one has an owner.

Asset owners update status on their findings. The vulnerability management lead checks priority, due dates and closures, and publishes a monthly snapshot of this tracker with the metrics in section 7.

2. Service levels

If the vulnerability management policy is in use, copy its matrix here (decision by asset tier, measured from detection). Otherwise use this simplified matrix, in calendar days from detection (Example):

Inputs:

• CVSS v4.0 (FIRST): record the score, the vector string and the label for the metric groups used (CVSS-B, CVSS-BT, CVSS-BE or CVSS-BTE). Where only a CVSS v3.x score exists, record it with its version.
• EPSS (FIRST): the probability that the vulnerability is exploited in the wild in the next 30 days. Record the score and the date of the score, because EPSS changes daily.
• CISA KEV: a listing means exploitation in the wild has been seen. A finding added to KEV after detection is re-prioritised, and its due date recalculated from the date of the KEV listing.

A shorter time set by a contract or regulation for a system overrides this matrix for that system.

3. Tracker fields

4. Tracker register

5. Finding lifecycle

A finding that reappears within [90 days] (Example, as set by the policy) of verified closure is reopened under its original ID, and its due date runs from the original detection date. A later recurrence is a new finding with a new ID.

6. Exceptions

When a finding cannot be remediated within its service level, the owner raises a security exception request (security/security-exception-request, DOC-ISMS-122) with the reason, compensating controls, the risk score on the 5 x 5 scale of the risk methodology (DOC-ISMS-010) and an expiry. The exception is approved at the authority the risk methodology (DOC-ISMS-010 section 2.4) sets for the residual risk: the risk owner for Low; the risk owner and department head for Medium (top management if the risk category is Averse, DOC-ISMS-015 section 9 rule 1); top management with a treatment decision for High, recorded in the risk acceptance record (DOC-ISMS-019). Critical residual risk is not approvable as an exception: treat it or stop the activity. Maximum duration is 12 months for Low or Medium and 6 months for High; at expiry the exception is reassessed, and a renewal is a new decision (DOC-ISMS-122 section 7).

7. Metrics

Worked quarter (Example): Quillmere Analytics Ltd, Q1 2027.

Checks: 12 + 84 - 71 = 25 open at the end. On-time remediation 64 / 71 = 90.1%, just above the 90% target. No Critical or KEV-listed finding was open at the end of the quarter.

8. Size tiers

9. Records and evidence

10. References

Related templates: security/vulnerability-management-policy, ops/patch-management-policy, security/security-exception-request, security/pentest-report, isms/isms-risk-acceptance-record, isms/security-monitoring-procedure, isms/control-evidence-matrix.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 (including Amd 1:2024) Annex A control A.8.8 and the guidance in ISO/IEC 27002:2022. Only the control number is used; the fields, service levels, examples and guidance are original wording, and no ISO/IEC text is reproduced. ISO and IEC standards are copyrighted: obtain the official standards from ISO, IEC or your national standards body. CVSS and EPSS are specifications of FIRST, and the KEV catalog is published by CISA; they are cited by name only. Check the current edition of every source before use. Certification decisions belong to the accredited certification body. Template licence: MIT.