Essential Eight PA-ML1.2 Up-to-date vulnerability scanner used for scanning activities
What it says
A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse a current vulnerability scanner to check for security issues in your apps.
This control is about using a vulnerability scanner that is always up-to-date to check for security weaknesses in your applications. Keeping the scanner updated is important because it helps you find and fix problems before hackers can exploit them.
Free. Save your status, tasks and notes.
Why it matters
If the scanner's vulnerability database is out of date, known CVEs may not be detected, leaving exploitable weaknesses unremediated.
How to implement
IT team should ensure the vulnerability scanner is updated daily by scheduling automatic updates or checking manually.
System administrator should configure the vulnerability scanner to run scans at least weekly to detect any weaknesses in software and applications.
Security officer should review scan reports to ensure identified vulnerabilities are addressed in a timely manner.
IT team should document and follow a clear process for updating the scanner's vulnerability database, including roles, schedule, and steps involved.
Keep it running
Keep scanner engines and vulnerability feeds current; run scheduled authenticated scans and triage findings quickly to drive timely remediation.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
When was the last time the vulnerability database was updated?
Look at
Examine the update logs of the vulnerability scanner.
Good evidence
The logs show that the database was updated within the last 24 hours.
- Check 2 of 2What an auditor asks for
Ask for
How often are vulnerability scans conducted?
Look at
Review the schedule and recent scan reports.
Good evidence
Scans are conducted at least weekly, as shown by recent reports.
Mappings
Closest match in ASD Information Security Manual: ISM-1808, Vulnerability scanning with updated tools, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
E8-PA-ML1.2 requires using a vulnerability scanner with an up-to-date vulnerability database for scanning activities. Annex A 8.8 is broader, requiring organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures, of which using an up-to-date scanner is one practical method. Annex A 8.8 extends beyond scanning to include evaluation and treatment activities that E8-PA-ML1.2 does not cover.
ASD Information Security Manual: 8 mappings
This control is equivalent to ISM-1808.
E8-PA-ML1.2 requires that vulnerability scanning activities use a vulnerability scanner with an up-to-date vulnerability database. ISM-1808 states the same requirement: using a vulnerability scanner with an up-to-date vulnerability database for vulnerability scanning. The scope and depth align closely, with both focusing on tool currency as a baseline condition for scanning quality.
This control partially meets ISM-1163.
E8-PA-ML1.2 requires use of a vulnerability scanner with an up-to-date vulnerability database for scanning activities. ISM-1163 includes vulnerability scanning (at least fortnightly) as part of a broader continuous monitoring plan, and would reasonably require current scanner signatures to be effective. ISM-1163 goes beyond E8-PA-ML1.2 by adding penetration testing, impact analysis, and risk-based mitigation requirements.
This control partially meets ISM-1698.
E8-PA-ML1.2 requires that vulnerability scanning activities use a vulnerability scanner with an up-to-date vulnerability database. ISM-1698 builds on this by mandating at least daily use of a vulnerability scanner to identify missing patches/updates for vulnerabilities in online services, which inherently relies on an up-to-date scanner. ISM-1698 adds prescriptive cadence and a specific scanning objective/scope (missing updates for online services) that E8-PA-ML1.2 does not specify.
This control partially meets ISM-1699.
E8-PA-ML1.2 requires use of a vulnerability scanner with an up-to-date vulnerability database for scanning activities. ISM-1699 mandates at least weekly scanning to identify missing patches/updates for specific high-risk software categories (office productivity suites, browsers, email clients, PDF applications, security products), which relies on an up-to-date vulnerability database. ISM-1699 adds defined frequency and software scope that E8-PA-ML1.2 does not include.
This control partially meets ISM-1700.
E8-PA-ML1.2 requires that vulnerability scanning uses a scanner with an up-to-date vulnerability database. ISM-1700 requires at least fortnightly scanning to identify missing patches/updates in a defined set of applications, which inherently relies on an up-to-date scanner database for accuracy. ISM-1700 is more prescriptive about scanning cadence and target asset class, whereas E8-PA-ML1.2 focuses on the currency of the scanner's vulnerability data.
This control partially meets ISM-1701.
E8-PA-ML1.2 requires vulnerability scanning activities to be performed with a scanner that has an up-to-date vulnerability database. ISM-1701 mandates at least daily scanning to identify missing patches/updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices, which depends on current vulnerability content to be meaningful. ISM-1701 adds explicit frequency and a specific internet-facing infrastructure scope that E8-PA-ML1.2 does not specify.
This control partially meets ISM-1703.
E8-PA-ML1.2 requires that vulnerability scanning activities use a scanner with an up-to-date vulnerability database. ISM-1703 requires at least fortnightly vulnerability scanning to identify missing patches/updates for vulnerabilities in drivers, which depends on current vulnerability data to detect relevant missing updates. ISM-1703 is narrower in asset scope (drivers) and more prescriptive about cadence than E8-PA-ML1.2, which is a general scanner currency requirement.
This control supports ISM-1693.
ISM-1693 requires patches and vendor mitigations for non-core applications to be applied within one month of release. E8-PA-ML1.2 supports ISM-1693 by requiring the use of a vulnerability scanner with an up-to-date vulnerability database, improving an organisation's ability to identify missing patches and prioritise remediation to meet the one-month deadline. E8-PA-ML1.2 does not itself mandate patch timeframes, so it strengthens but does not replace ISM-1693.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-06.1Continuously scan and assess assets for known software and configuration weaknessesPartially overlaps
This control partially overlaps IT.PRO-06.1.
IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to identify known software and configuration weaknesses; E8-PA-ML1.2 requires the scanner used to have an up-to-date vulnerability database, a condition on how that scanning is done.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.