Essential Eight PA-ML1.4 Weekly scanning for missing patches or updates in key software
What it says
A vulnerability scanner is used at least weekly to identify missing patches or updates for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse a tool every week to check and update key software like browsers and office apps to fix security issues.
This control is about using a special tool each week to check if important software on your computers, like web browsers and email programs, needs updating to fix security problems. It's important because outdated software can have weaknesses that cybercriminals exploit, potentially leading to data loss or other serious issues.
Free. Save your status, tasks and notes.
Why it matters
Unpatched office apps, browsers, email clients and PDF tools are common attack paths. Weekly vulnerability scans identify missing patches before exploitation.
How to implement
IT team should choose a reliable vulnerability scanning tool.
This tool should be able to identify outdated or unpatched software across all devices used in the organisation.
The system administrator should schedule weekly scans using the chosen tool.
Set up an automatic scan every week to ensure that no important software updates are missed.
Security officer should ensure the vulnerability database used by the tool is updated frequently.
This guarantees that the scanning tool recognises all current threats and vulnerabilities.
IT team should prioritise the results of the scans.
After each scan, make a list of software vulnerabilities and address the most critical ones as soon as possible.
System administrator should maintain records of all scans conducted.
Keep a log of the scan dates, the issues found, and the actions taken in response to ensure a clear audit trail.
Keep it running
Run an authenticated vulnerability scanner at least weekly across office suites, browsers/extensions, email clients, PDF and security tools; track findings to patch quickly.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Can you show how you perform the weekly vulnerability scans?
Look at
Examine the scheduled job in the scanning tool and check past scan logs.
Good evidence
There are consistent weekly scan logs showing identified vulnerabilities and corresponding patch updates applied.
- Check 2 of 2What an auditor asks for
Ask for
How do you ensure your vulnerability scanner's database is current?
Look at
Verify the last update date of the vulnerability database in the scanning tool.
Good evidence
The vulnerability database is updated daily, ensuring all newly identified threats are covered.
Mappings
Closest match in ASD Information Security Manual: ISM-1699, Weekly vulnerability scanning for software updates, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
E8-PA-ML1.4 requires organisations to use weekly vulnerability scanning to identify missing patches/updates for common end-user software and security products. ISO/IEC 27001:2022 Annex A 8.8 requires organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures. E8-PA-ML1.4 supports Annex A 8.8 by operationalising one way to identify vulnerability exposure (missing patches) on a recurring basis, although Annex A 8.8 is broader and not limited to scanning or specific software classes.
ASD Information Security Manual: 13 mappings
This control is equivalent to ISM-1699.
E8-PA-ML1.4 requires a vulnerability scanner be used at least weekly to identify missing patches or updates for office productivity suites, web browsers and extensions, email clients, PDF applications, and security products. ISM-1699 states the same minimum frequency, the same scanning approach, and the same software scope. Implementing E8-PA-ML1.4 would largely satisfy ISM-1699 and vice versa.
This control partially meets ISM-1143.
E8-PA-ML1.4 requires organisations to conduct weekly vulnerability scanning specifically to identify missing patches/updates in key software categories. ISM-1143 requires establishing and maintaining patch management processes and procedures, which would typically include how scanning identifies patch gaps and triggers remediation. E8-PA-ML1.4 is one specific operational activity within the broader patch management governance required by ISM-1143.
- ISM-1526System owners continuously monitor security and manage threats, risks and controlsPartially meets
This control partially meets ISM-1526.
ISM-1526 requires system owners to continuously monitor system security and actively manage cyber threats, security risks and controls throughout operations. E8-PA-ML1.4 fits within this by mandating at least weekly vulnerability scanning to find missing patches in key software, which is an ongoing monitoring activity that informs risk/control management. ISM-1526 is broader because it covers continuous monitoring and management across the full threat/risk/control set, not just patch-related vulnerability scanning.
This control partially overlaps ISM-1163.
ISM-1163 requires a continuous monitoring plan including regular vulnerability scanning and mitigation. E8-PA-ML1.4 relates by requiring weekly scanning to identify missing patches for specific applications, but does not cover penetration testing or comprehensive risk analysis.
This control partially overlaps ISM-1693.
E8-PA-ML1.4 requires weekly scanning to identify missing patches or updates, but only for office suites, browsers/extensions, email clients, PDF software, and security products. ISM-1693 requires patching within one month for applications outside those key categories. They overlap in the general patch/vulnerability management intent, but E8-PA-ML1.4 focuses on detection for a specific application set while ISM-1693 focuses on remediation timelines for other applications.
This control partially overlaps ISM-1700.
E8-PA-ML1.4 requires organisations to use a vulnerability scanner at least weekly to identify missing patches or updates in key end-user software like office suites, browsers/extensions, email clients, PDF software, and security products. ISM-1700 similarly mandates regular vulnerability scanning to find missing patches/updates but applies to applications other than those listed in E8-PA-ML1.4 and sets a fortnightly minimum. They overlap on the method (vulnerability scanning for missing patches) but differ in target software scope and scanning frequency.
This control partially overlaps ISM-1703.
E8-PA-ML1.4 requires weekly vulnerability scanning to identify missing patches or updates for key end-user and security applications. ISM-1703 requires vulnerability scanning at least fortnightly to identify missing patches or updates for drivers. The controls overlap on scanner-based identification of missing updates, but they differ materially in asset type (applications vs drivers) and required cadence (weekly vs fortnightly).
This control supports ISM-0298.
E8-PA-ML1.4 requires weekly vulnerability scanning to identify missing patches or updates in key software categories. ISM-0298 requires a centralised and managed approach to deploy patches/updates with integrity and confirmation of successful application. E8-PA-ML1.4 supports ISM-0298 by supplying regular, scanner-derived evidence of what is missing, while ISM-0298 focuses on the controlled distribution and verification of patching rather than detection frequency.
This control supports ISM-1467.
ISM-1467 requires organisations to ensure the latest releases of specified user applications and security products are used. E8-PA-ML1.4 supports ISM-1467 by requiring weekly vulnerability scanning to identify missing patches or updates in those same software categories, helping detect where systems have drifted from current versions. E8-PA-ML1.4 is detection/assurance focused, while ISM-1467 is the preventative requirement to actually keep software current.
This control supports ISM-1691.
E8-PA-ML1.4 requires weekly scanning to identify missing patches or updates in key software so remediation can be actioned. ISM-1691 requires those patches/updates/mitigations for the same software categories to be applied within two weeks of release. Weekly scanning under E8-PA-ML1.4 supports ISM-1691 by providing the detection and visibility needed to meet the two-week patch application timeframe, but scanning alone does not ensure patching occurs.
This control supports ISM-1692.
E8-PA-ML1.4 requires weekly scanning to identify missing patches or updates for vulnerabilities in key user applications and security products. ISM-1692 requires those patches/updates to be applied within 48 hours when vendors rate vulnerabilities as critical or when working exploits exist. E8-PA-ML1.4 supports ISM-1692 by providing a detection mechanism to quickly identify which assets are missing urgent patches, although it does not impose the 48-hour remediation timeframe.
This control supports ISM-1754.
ISM-1754 requires vulnerabilities identified in software to be resolved in a timely manner. E8-PA-ML1.4 supports ISM-1754 by operationalising the discovery of patch-related vulnerabilities via at least weekly scanning of common applications, enabling faster identification and prioritisation of fixes. E8-PA-ML1.4 focuses on detection of missing patches, whereas ISM-1754 focuses on timely remediation once vulnerabilities are identified.
This control supports ISM-1901.
E8-PA-ML1.4 requires weekly scanning to identify missing patches or updates for vulnerabilities in key user applications and security products. ISM-1901 requires applying patches for the same software categories within two weeks where vendors rate vulnerabilities as non-critical and no working exploits exist. E8-PA-ML1.4 supports ISM-1901 by helping identify which non-critical updates are missing, but ISM-1901 adds conditional decision criteria and a remediation requirement beyond scanning.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-06.1Continuously scan and assess assets for known software and configuration weaknessesPartially overlaps
This control partially overlaps IT.PRO-06.1.
IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to identify known weaknesses; E8-PA-ML1.4 requires scanning at least weekly for missing patches or updates in office, browser, email, PDF and security software, a specific case of it.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.