Essential Eight PA-ML1.2Up-to-date vulnerability scanner used for scanning activities
Official control statement
A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Use a current vulnerability scanner to check for security issues in your apps.
What this means in practice
This control is about using a vulnerability scanner that is always up-to-date to check for security weaknesses in your applications. Keeping the scanner updated is important because it helps you find and fix problems before hackers can exploit them.
Framework
ASD Essential Eight
Control effect (Control Stack)
Detective
E8 mitigation strategy
Patch applications
Classifications
N/A
Official last update
N/A
Control Stack last updated
29 Sept 2026
E8 maturity levels
ML1
Why it matters
If the scanner's vulnerability database is out of date, known CVEs may not be detected, leaving exploitable weaknesses unremediated.
Operational notes
Keep scanner engines and vulnerability feeds current; run scheduled authenticated scans and triage findings quickly to drive timely remediation.
Implementation tips
- IT team should ensure the vulnerability scanner is updated daily by scheduling automatic updates or checking manually.
- System administrator should configure the vulnerability scanner to run scans at least weekly to detect any weaknesses in software and applications.
- Security officer should review scan reports to ensure identified vulnerabilities are addressed in a timely manner.
- IT team should document and follow a clear process for updating the scanner's vulnerability database, including roles, schedule, and steps involved.
Audit / evidence tips
- AskWhen was the last time the vulnerability database was updated?
- Look atExamine the update logs of the vulnerability scanner
- GoodThe logs show that the database was updated within the last 24 hours
- AskHow often are vulnerability scans conducted?
- Look atReview the schedule and recent scan reports
- GoodScans are conducted at least weekly, as shown by recent reports
Cross-framework mappings
How E8-PA-ML1.2 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.8 | E8-PA-ML1.2 requires using a vulnerability scanner with an up-to-date vulnerability database for scanning activities | |
ASD ISM
| Control | Notes | Details |
|---|---|---|
equalEquivalent(1)expand_less | ||
| ISM-1808 | E8-PA-ML1.2 requires that vulnerability scanning activities use a vulnerability scanner with an up-to-date vulnerability database | |
layersPartially meets(6)expand_less | ||
| ISM-1163 | E8-PA-ML1.2 requires use of a vulnerability scanner with an up-to-date vulnerability database for scanning activities | |
| ISM-1698 | E8-PA-ML1.2 requires that vulnerability scanning activities use a vulnerability scanner with an up-to-date vulnerability database | |
| ISM-1699 | E8-PA-ML1.2 requires use of a vulnerability scanner with an up-to-date vulnerability database for scanning activities | |
| ISM-1700 | E8-PA-ML1.2 requires that vulnerability scanning uses a scanner with an up-to-date vulnerability database | |
| ISM-1701 | E8-PA-ML1.2 requires vulnerability scanning activities to be performed with a scanner that has an up-to-date vulnerability database | |
| ISM-1703 | E8-PA-ML1.2 requires that vulnerability scanning activities use a scanner with an up-to-date vulnerability database | |
handshakeSupports(1)expand_less | ||
| ISM-1693 | ISM-1693 requires patches and vendor mitigations for non-core applications to be applied within one month of release | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related Essential 8 controls in Patch applications
See all Patch applications controls, or browse the full ASD Essential Eight library.