Patch management and vulnerability audit program.
How to audit whether vulnerabilities are detected, assessed by risk and fixed within defined deadlines, related to NIS2, the module OPS.1.1.3 and Annex A of ISO/IEC 27001.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether the organisation systematically detects known vulnerabilities in systems and software, assesses them by risk and fixes them in time, and whether exceptions are handled in a controlled and traceable way. It also assesses whether the patch level is evidenced by reports.
Scope
- Servers, workstations, network and security components, databases and applications under the organisation’s responsibility
- Firmware, third-party software and libraries, where used in in-house development
- Vulnerability scans and the procedures for assessment, testing, deployment and exceptions
- Out of scope: penetration tests, unless agreed separately; systems fully operated by a provider, other than through the steering of that provider
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | A patch and vulnerability management process exists, is approved and sets deadlines by criticality. | BSI OPS.1.1.3; ISO/IEC 27001:2022 Annex A 8.8 | Read the process description and check whether deadlines, roles, exceptions and escalation are defined. | Process description with approval, deadline matrix |
| 2 | A current inventory of systems and installed software serves as the basis. | ISO/IEC 27001:2022 Annex A 5.9 | Compare the inventory with a network scan or directory data and identify systems not recorded. | Inventory, comparison list |
| 3 | Sources of vulnerability information are defined and evaluated by named people. | BSI OPS.1.1.3 | Ask for the sources and owners and, for a recent vulnerability, trace the path from notification to assessment. | List of sources, responsibilities, assessment note for an example |
| 4 | New vulnerabilities are assessed for relevance and risk and the assessment is documented. | BSI OPS.1.1.3; ISO/IEC 27001:2022 Annex A 8.8 | Select five highly critical vulnerabilities from one quarter and trace the assessment. | Assessment records, tickets |
| 5 | Vulnerability scans run regularly and cover the systems in scope. | ISO/IEC 27001:2022 Annex A 8.8 | Compare the scan plan and scan ranges with the inventory and review the latest reports. | Scan plan, scan reports, coverage overview |
| 6 | Critical vulnerabilities are fixed within the defined deadline and overruns are followed up. | BSI OPS.1.1.3 | For a sample of critical vulnerabilities, determine the time from awareness to remediation and compare it with the deadline. | Evaluation of open and closed vulnerabilities, tickets, escalations |
| 7 | Patches are tested before deployment in production and fallback options exist. | BSI OPS.1.1.3 | Trace the testing and approval flow for two recent patches. | Test records, approvals, fallback plan |
| 8 | Exceptions are justified, approved by a competent body, time-limited and backed by compensating measures. | BSI OPS.1.1.3; ISO/IEC 27001:2022 Annex A 8.8 | Review the list of exceptions and, for a sample, check justification, approval, time limit and compensating measures. | Exception list with approvals and compensating measures |
| 9 | Systems and software without vendor support are identified and handled under a plan. | BSI OPS.1.1.3 | Filter the inventory for unsupported systems and review the plans for replacement or protection. | List of unsupported systems, replacement plans, risk acceptance |
| 10 | The patch level covers all kinds of components: operating systems, applications, network devices, firmware and third-party software. | ISO/IEC 27001:2022 Annex A 8.8 | Review patch level reports per component type and identify gaps in coverage. | Patch level reports, coverage overview |
| 11 | Effectiveness is evidenced by repeated scans or patch level reports. | NIS2 Directive Art. 21(2)(f) | For remediated vulnerabilities, check whether a repeated scan confirms success. | Follow-up scans, closure notes |
| 12 | Metrics on patch level and compliance with deadlines are reported to those responsible and lead to action. | NIS2 Directive Art. 21(2)(f) | Read the reports of the last twelve months and trace the decisions on deviations. | Metric reports, minutes, action lists |
| 13 | For vulnerabilities in the entity’s own products and services there is, where applicable, a procedure to receive and handle reports. | NIS2 Directive Art. 21(2)(e) | Check the reporting channel, responsibilities and the handling of an example. | Procedure description, contact address, handling record |
Documents to request
- Process description for patch and vulnerability management with deadline matrix
- Inventory of systems and software
- Scan plan and vulnerability reports of recent quarters
- Evaluation of open and closed vulnerabilities with time to remediation
- Patch level reports per component type
- List of exceptions with approvals and compensating measures
- List of systems without vendor support and replacement plans
- Metric reports to those responsible
Typical findings
- The inventory is incomplete, so systems are missing from the scan and the patch process.
- Deadlines are defined but regularly exceeded for critical vulnerabilities, without escalation.
- Network devices and firmware are not part of the patch process.
- Exceptions run without end date and without compensating measures.
- Systems without vendor support are in operation and no replacement plan exists.
- Remediation is not confirmed by a repeated scan.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing