Essential Eight PA-ML1.1 Automated asset discovery at least fortnightly
What it says
An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse automated tools every two weeks to find all devices for security checks.
This control is about making sure you have a good handle on all the computers and devices within your business by automatically finding them every two weeks. It's important because missing even one device means it could have vulnerabilities that hackers can exploit. Regularly knowing all your assets helps you ensure they are secure and up to date.
Free. Save your status, tasks and notes.
Why it matters
Without fortnightly automated asset discovery, unknown or unmanaged devices can miss vulnerability scanning, leaving exploitable entry points in the environment.
How to implement
IT Team: Set up an automated tool to regularly scan your network for all connected devices every two weeks.
Choose a tool that meets your needs and follow the guide provided to configure regular scans.
System Administrator: Maintain a list of all detected devices from each scan.
Ensure the list is current and audit it at least every fortnight to detect new or unauthorised devices.
Security Officer: Align asset discovery scans with your vulnerability scans.
This might involve scheduling both tasks to occur at the same time to streamline monitoring efforts.
IT Manager: Evaluate and choose a reliable asset discovery tool or software that can be integrated with your existing systems to ensure there are no gaps in device detection.
Keep it running
Schedule automated discovery at least every fortnight; compare findings to the asset register and investigate new, missing or rogue devices so they are included in vulnerability scanning.
Evidence and audit
- Check 1 of 1What an auditor asks for
Ask for
How do you discover all the assets in your organisation?
Look at
Request to see a demonstration of the asset discovery scans along with scanned reports from the last few cycles, paying attention to dates and the list of identified devices.
Good evidence
The organisation uses an automated tool to scan for assets every fortnight. They maintain detailed records of all devices, and the reports are regularly updated and include all asset types, such as workstations and printers.
Mappings
Closest match in ASD Information Security Manual: ISM-1807, Automated asset discovery for vulnerability scanning, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control supports A.8.8.
E8-PA-ML1.1 requires fortnightly automated asset discovery to identify assets for follow-on vulnerability scanning. Annex A 8.8 requires obtaining information about technical vulnerabilities, evaluating exposure and taking appropriate measures. E8-PA-ML1.1 supports Annex A 8.8 by helping ensure the organisation knows what systems exist so vulnerability information and exposure evaluations are complete, but Annex A 8.8 is broader and does not prescribe asset discovery or a fortnightly cadence.
ASD Information Security Manual: 7 mappings
This control is equivalent to ISM-1807.
E8-PA-ML1.1 requires an automated method of asset discovery to be run at least fortnightly to detect assets for subsequent vulnerability scanning. ISM-1807 states the same requirement with the same cadence and purpose, directly aligning the control intent and implementation outcome. Implementing E8-PA-ML1.1 would largely satisfy ISM-1807 (and vice versa) because both focus on automated discovery as an input to vulnerability scanning coverage.
This control partially overlaps ISM-0336.
E8-PA-ML1.1 requires an automated method of asset discovery at least fortnightly to identify assets for subsequent vulnerability scanning. ISM-0336 requires a networked IT equipment register to be developed, implemented, maintained and verified regularly. They overlap in maintaining awareness of organisational assets, but E8-PA-ML1.1 is a technical discovery activity with a defined cadence and scanning purpose, while ISM-0336 is a broader governance record-keeping requirement that may be manual and is not explicitly tied to vulnerability scanning.
This control supports ISM-1702.
E8-PA-ML1.1 requires automated asset discovery at least fortnightly so organisations can detect what assets exist for follow-on vulnerability scanning. ISM-1702 requires using a vulnerability scanner at least fortnightly for workstations, non-internet-facing servers and non-internet-facing network devices to identify missing patches. E8-PA-ML1.1 supports ISM-1702 by ensuring the scanning target list is complete and current, but it does not itself perform vulnerability scanning or specify asset classes in scope for scanning.
This control supports ISM-1703.
E8-PA-ML1.1 requires running automated asset discovery at least fortnightly to identify assets that should be included in vulnerability scanning activities. ISM-1703 requires using a vulnerability scanner at least fortnightly to identify missing patches or updates for vulnerabilities in drivers. E8-PA-ML1.1 supports ISM-1703 by helping ensure hosts and devices that contain drivers are discovered and therefore included in scanning scope, although it does not address driver-level scanning itself.
This control supports ISM-1752.
E8-PA-ML1.1 requires automated asset discovery at least fortnightly to support detection of assets for later vulnerability scanning. ISM-1752 mandates fortnightly vulnerability scanning for certain non-workstation equipment to find missing patches or updates. E8-PA-ML1.1 supports ISM-1752 by improving visibility of discoverable devices so the scanner coverage includes newly connected or previously unknown assets, but it does not set requirements for the scanning tool or patch findings.
This control supports ISM-1966.
ISM-1966 requires the CISO to maintain and regularly verify a register of organisational systems. E8-PA-ML1.1 involves automated asset discovery to detect assets for vulnerability scanning, which assists in keeping the ISM-1966 register accurate. E8-PA-ML1.1 focuses on discovery for scanning, whereas ISM-1966 does not prescribe any specific asset discovery mechanisms.
This control depends on ISM-1163.
E8-PA-ML1.1 requires fortnightly automated asset discovery so an organisation can detect assets that need to be included in vulnerability scanning. ISM-1163 requires a continuous monitoring plan that includes at least fortnightly vulnerability scanning and broader assessment/testing activities. E8-PA-ML1.1 supports ISM-1163 by ensuring the scan scope is complete (including newly connected or unmanaged assets), but ISM-1163 extends well beyond discovery into scanning, assessment and remediation planning.
ASD Essentials for enterprise IT: 3 mappings
- IT.DET-05.1Periodically review detection coverage for gaps as assets, services and architecture changePartially overlaps
This control partially overlaps IT.DET-05.1.
IT.DET-05.1 requires periodic reviews of detection coverage to find gaps from new assets, services or architectural changes; E8-PA-ML1.1 requires automated asset discovery at least fortnightly for vulnerability scanning, which can surface new assets whose detection coverage those reviews should check.
- IT.IDE-01.1Use an approved inventory with automated discovery of new and changed assetsPartially overlaps
This control partially overlaps IT.IDE-01.1.
IT.IDE-01.1 requires an approved asset inventory mechanism with automated discovery of new and changed physical and non-physical assets; E8-PA-ML1.1 overlaps on automated discovery, requiring it at least fortnightly to detect assets for later vulnerability scanning.
- IT.PRO-06.1Continuously scan and assess assets for known software and configuration weaknessesPartially overlaps
This control partially overlaps IT.PRO-06.1.
IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to identify known software and configuration weaknesses; E8-PA-ML1.1 supports it by requiring automated asset discovery at least fortnightly to detect assets for later scanning.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.