ASD Essentials IT.PRO-06.1 Continuously Scan and Assess Assets for Known Software and Configuration Weaknesses
What it says
Identify known software and configuration weaknesses of assets through continuous and repeatable assessment activities, including vulnerability scanning activities.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishFinds known software flaws and weak settings on all systems through ongoing, repeatable checks, including vulnerability scans and reviews of security advisories.
Many weaknesses are already known, such as software flaws and risky settings like default passwords. The job is to keep finding them. To meet this, scan every system for both, often enough to respond to new weaknesses in time, using the same saved scan settings each time. Read supplier and ASD security alerts, and work out which systems each one affects and how badly. Review and rank all findings within your set timeframes.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?ASD orders the work by domain: apply this action to each ticked domain, phase by phase.
- Phase 3
Why it matters
Weaknesses nobody finds stay open. Attackers use unpatched internet-facing services to get in, weak internal services to spread, and flawed browsers to take over staff computers. Known flaws also let them gain admin control, and the first sign may be the attack itself.
How to implement
The security manager should approve a procedure covering scope, how each system type is assessed, how often based on risk, and deadlines for reviewing results.
Automated scans use the same saved settings each time.
The scanning team should build the scan list from the asset list and network sweeps for unlisted devices, rechecking it each cycle.
Cover every ASD domain, agree scan times with critical service owners, and put scanning software on laptops.
Scanning administrators should use scans that sign in to each system, or installed scanning software, to find missing patches and vulnerable versions.
Add checks against approved standard settings to find risky ones, such as default passwords and insecure protocols.
The security team should subscribe to supplier and ASD security alerts and review new ones on a set schedule.
Record which systems each affects and the likely impact, matching exact versions for firewalls and similar devices.
The vulnerability management lead should have results and alert reviews done within the set timeframes, with false alarms explained.
Rank confirmed findings by severity, whether attackers already use them, exposure and system importance, and give each an owner.
Keep it running
The scanning team keeps the scanner's list of known flaws up to date. They run a targeted check whenever a serious new weakness is published. Set scan frequency by risk, usually most often for internet-facing systems. Each cycle, compare the systems scanned with the asset list, and follow up failed scans. Extend coverage in ASD's priority order: internet-facing and sign-in systems first, then critical and admin systems, then business systems and staff devices.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the set scan frequencies and the scanner's job history since the last assessment.
Look at
Whether scans failed or were skipped, ran too rarely to act in time, or had outdated flaw data.
Good evidence
Scans complete on schedule, failures are followed up, and the scanner's flaw data is current.
- Check 2 of 5What an auditor asks for
Ask for
Request the asset list, current scan target lists and recent scan reports for sampled systems.
Look at
Whether systems such as firewalls, separated admin systems or roaming laptops are missing from scans.
Good evidence
Every applicable system is in routine scanning, and target lists match the asset list.
- Check 3 of 5What an auditor asks for
Ask for
Ask for scan settings and recent results for a server, network device and staff computer.
Look at
Whether results show only missing patches with no setting findings, or scans run without signing in.
Good evidence
Results for each type include risky settings, as well as missing patches.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the security alert review log, and trace recent alerts for products in use.
Look at
Whether alerts are reviewed only now and then or for some systems, with no impact recorded.
Good evidence
Each traced alert is logged with affected systems, matched by exact version, and its likely impact.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the set review timeframes and the findings register for the last few cycles.
Look at
Whether results sat unreviewed past the timeframes, were filed unranked, or false alarms had no reason.
Good evidence
Results are reviewed by their deadline, and each confirmed weakness has a priority and an owner.
ASD indicators of good practice (12)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(3)
- NE-1Vulnerability scanning activities are not undertaken.
- NE-2No routine vulnerability assessment activity has been conducted within a period defined by the organisation.
- NE-3Advisories for relevant software and configuration weaknesses for organisational assets are not reviewed and assessed for impact.
Partially effective(5)
- PE-1Vulnerability scanning is deployed but does not cover all applicable assets.
- PE-2Vulnerability scans are conducted but results are not reviewed and prioritised within timeframes defined by the organisation.
- PE-3Vulnerability scans are conducted but frequency is not regular enough to enable timely response.
- PE-4Scanning covers software vulnerabilities but not configuration weaknesses.
- PE-5Advisories for relevant software and configuration weaknesses for organisational assets are reviewed on an ad hoc basis, or only for some assets.
Fully effective(4)
- FE-1All applicable assets are included in routine vulnerability scanning, and scanning frequency enables timely response.
- FE-2Scanning covers both software vulnerabilities and configuration weaknesses.
- FE-3Results are reviewed and prioritised within timeframes defined by the organisation.
- FE-4Advisories for relevant software and configuration weaknesses in all organisational assets are regularly reviewed and assessed for impact.
Mappings
Closest match in ISO/IEC 27001: A.8.8, Management of Technical Vulnerabilities, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.8.
IT.PRO-06.1 requires known software and configuration weaknesses in assets to be identified through continuous and repeatable assessment activities, including vulnerability scanning. This directly delivers the gathering of technical vulnerability information and evaluation of the organisation's exposure required by Annex A 8.8. Annex A 8.8 is broader, as it also requires appropriate measures to be taken to address the vulnerabilities identified.
This control partially overlaps A.8.9.
IT.PRO-06.1 requires continuous and repeatable assessment activities, including vulnerability scanning, to identify known software and configuration weaknesses in assets. Its assessment of configuration weaknesses shares common ground with the monitoring and review of security configurations required by Annex A 8.9. Each has distinct scope: IT.PRO-06.1 also covers software vulnerabilities, while Annex A 8.9 also requires configurations to be established, documented and implemented.
ASD Essential Eight: 11 mappings
This control partially overlaps E8-PA-ML1.1.
IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to identify known software and configuration weaknesses; E8-PA-ML1.1 supports it by requiring automated asset discovery at least fortnightly to detect assets for later scanning.
This control partially overlaps E8-PA-ML1.2.
IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to identify known software and configuration weaknesses; E8-PA-ML1.2 requires the scanner used to have an up-to-date vulnerability database, a condition on how that scanning is done.
This control partially overlaps E8-PA-ML1.3.
IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to identify known software and configuration weaknesses; E8-PA-ML1.3 requires vulnerability scanning at least daily for missing patches or updates in online services, a specific case of it.
This control partially overlaps E8-PA-ML1.4.
IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to identify known weaknesses; E8-PA-ML1.4 requires scanning at least weekly for missing patches or updates in office, browser, email, PDF and security software, a specific case of it.
This control partially overlaps E8-PA-ML2.1.
IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to identify known weaknesses; E8-PA-ML2.1 is one case: scanning at least fortnightly for missing patches in applications other than office, browser, email, PDF and security software.
This control partially overlaps E8-PO-ML1.1.
IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to identify known software and configuration weaknesses; E8-PO-ML1.1 supports it by requiring automated asset discovery at least fortnightly to detect assets for subsequent scanning.
This control partially overlaps E8-PO-ML1.2.
IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to identify known software and configuration weaknesses; E8-PO-ML1.2 requires the scanner to have an up-to-date vulnerability database, so that scanning works from current data.
This control partially overlaps E8-PO-ML1.3.
IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to identify known weaknesses; E8-PO-ML1.3 is one case: scanning at least daily for missing patches or updates in operating systems of internet-facing servers and network devices.
This control partially overlaps E8-PO-ML1.4.
IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to find known weaknesses; E8-PO-ML1.4 is one case: scanning at least fortnightly for missing patches in operating systems of workstations and non-internet-facing servers and network devices.
- E8-PO-ML3.1Vulnerability scanner used fortnightly to identify missing driver patchesPartially overlaps
This control partially overlaps E8-PO-ML3.1.
IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to identify known software and configuration weaknesses; E8-PO-ML3.1 requires scanning at least fortnightly for missing patches or updates in drivers, one specific case of that.
This control partially overlaps E8-PO-ML3.2.
IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to identify known software and configuration weaknesses; E8-PO-ML3.2 requires scanning at least fortnightly for missing patches or updates in firmware, one specific case of that.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.