Essential Eight PA-ML1.3 Daily vulnerability scanning for missing patches in online services
What it says
A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse a daily scanner to find missing security updates for online services.
This control is about checking every day if our online services need important updates or patches. It's like running a daily check-up on your car to make sure it's safe to drive. Without these checks, our online services could become vulnerable to cyber attacks that exploit outdated software.
Free. Save your status, tasks and notes.
Why it matters
Without daily vulnerability scans of online services, missing patches can go unnoticed and be rapidly exploited, increasing compromise risk.
How to implement
The IT team should set up a daily schedule for using a vulnerability scanner on all online services to check for missing updates.
The system administrator should choose a vulnerability scanner with an up-to-date database to ensure the scanner is aware of the latest threats.
The security officer should ensure the scanner runs automatically at a set time each day and review the results to identify any critical updates needed.
The IT team should configure the scanner to send automated reports or alerts to responsible team members when missing patches are detected.
The system administrator should regularly check and update the vulnerability scanner itself to make sure it works with the latest threat intelligence.
Keep it running
Review daily vulnerability scan results for internet-facing services, triage missing patches, and track remediation to closure within agreed timeframes.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How often is the vulnerability scanner run for online services?
Look at
Examine the logs from the vulnerability scanner to check the frequency of scans.
Good evidence
Logs show daily scans with timestamps indicating recent activities.
- Check 2 of 2What an auditor asks for
Ask for
Is the vulnerability database of the scanner being updated regularly?
Look at
Review the update logs of the vulnerability scanner's database.
Good evidence
The logs indicate that updates are applied within the last 24 hours before each scan.
Mappings
Closest match in ASD Information Security Manual: ISM-1698, Daily vulnerability scanning for missing updates, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
E8-PA-ML1.3 requires a specific operational practice: using a vulnerability scanner at least daily to identify missing patches or updates for vulnerabilities in online services. ISO/IEC 27001:2022 Annex A 8.8 is broader, requiring organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures across information systems in use. E8-PA-ML1.3 is one concrete mechanism that can be used to meet part of Annex A 8.8, but Annex A 8.8 extends beyond scanning frequency and includes evaluation and treatment decisions.
ASD Information Security Manual: 5 mappings
This control is equivalent to ISM-1698.
E8-PA-ML1.3 requires a vulnerability scanner to be used at least daily to identify missing patches or updates for vulnerabilities in online services. ISM-1698 states the same daily scanning requirement for missing updates in online services. The scope, frequency and objective align closely, so implementing either would largely satisfy the other.
This control partially overlaps ISM-1701.
E8-PA-ML1.3 requires daily vulnerability scanning to identify missing patches or updates for vulnerabilities in online services. ISM-1701 also mandates at least daily scanning, but focuses specifically on missing patches in operating systems of internet-facing servers and internet-facing network devices rather than the broader online service stack. They overlap on daily scanning for internet-exposed components, but each has a different primary scope (service-layer vs OS/device-layer).
This control supports ISM-0298.
E8-PA-ML1.3 requires daily scanning to identify missing patches or updates for vulnerabilities in online services. ISM-0298 requires a centralised and managed approach to patching that maintains integrity and confirms successful application, which helps remediate the gaps identified by E8-PA-ML1.3. The controls complement each other: E8-PA-ML1.3 finds missing patches, while ISM-0298 strengthens consistent deployment and verification of those patches.
This control supports ISM-1143.
E8-PA-ML1.3 requires daily vulnerability scanning to identify missing patches or updates for vulnerabilities in online services. ISM-1143 requires organisations to develop, implement and maintain patch management processes and procedures, which provides the governance and workflow to action the missing patches identified by E8-PA-ML1.3. The primary is detection-focused, while ISM-1143 is process-focused on managing patching end-to-end.
This control depends on ISM-1808.
E8-PA-ML1.3 requires daily vulnerability scanning to identify missing patches or updates for vulnerabilities in online services. ISM-1808 requires the vulnerability scanner to have an up-to-date vulnerability database, which is necessary for E8-PA-ML1.3 scanning results to be accurate and complete. Without ISM-1808, the daily scanning in E8-PA-ML1.3 can be performed but would be materially less effective and potentially misleading.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-06.1Continuously scan and assess assets for known software and configuration weaknessesPartially overlaps
This control partially overlaps IT.PRO-06.1.
IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to identify known software and configuration weaknesses; E8-PA-ML1.3 requires vulnerability scanning at least daily for missing patches or updates in online services, a specific case of it.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.