Essential Eight PA-ML1.6 Apply non-critical patches for online services within two weeks
What it says
Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishInstall updates for online services within two weeks if not critical and no exploits exist.
This control is about making sure that any minor issues in online services are fixed within two weeks. Even if these issues aren't critical, ignoring them could mean leaving a door open for potential attackers. Regular updates keep your systems safe by patching vulnerabilities before they can be exploited.
Free. Save your status, tasks and notes.
Why it matters
Delaying non-critical patches for online services can allow later exploit chaining, turning low-risk flaws into outages or unauthorised access.
How to implement
IT team should identify all online services in use by regularly reviewing the software inventory, ensuring all services are accounted for.
System administrator should track non-critical patches by checking vendor notifications and update websites weekly.
Security officer should ensure patches are applied by setting reminders for the IT team to install updates within two weeks of their release.
IT team should automate the patching process using patch management tools, which can be configured to apply updates automatically according to the schedule.
Business owner should conduct a monthly review to confirm with the IT team that non-critical patches are completed on time.
Keep it running
Maintain a fortnightly patch review for internet-facing services; apply vendor non-critical patches within 14 days when no exploits are known.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How do you identify which online services need patching within two weeks?
Look at
Review the software inventory list and compare it against recent updates released by vendors.
Good evidence
The organisation maintains an up-to-date list of online services and receives notifications from vendors about patches, then applies them within two weeks when assessed as non-critical.
- Check 2 of 2What an auditor asks for
Ask for
How does the organisation ensure patches are applied within the required timeframe?
Look at
Examine the patch management tool's configuration and logs showing patch application dates.
Good evidence
The organisation uses an automated patch management system that logs patch release and application dates, consistently showing compliance with the two-week requirement.
Mappings
Closest match in ASD Information Security Manual: ISM-1690, Timely application of non-critical vulnerability patches, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
E8-PA-ML1.6 requires non-critical vendor patches for online services be applied within two weeks when no working exploits exist. ISO/IEC 27001:2022 Annex A 8.8 requires organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures, which fits the vulnerability management within E8-PA-ML1.6's prescriptive, time-bound implementation.
ASD Information Security Manual: 9 mappings
This control is equivalent to ISM-1690.
E8-PA-ML1.6 requires organisations to apply non-critical patches, updates or vendor mitigations for vulnerabilities in online services within two weeks when no working exploits exist. ISM-1690 states the same timing, scope (online services) and condition (non-critical, no exploits) for applying vendor mitigations. Implementing ISM-1690 would largely satisfy E8-PA-ML1.6 with no material gaps in intent or coverage.
This control partially meets ISM-1163.
E8-PA-ML1.6 requires applying non-critical patches for online services within two weeks where no working exploits exist. ISM-1163 establishes a continuous monitoring plan including regular vulnerability scanning, analysis of vulnerabilities, and implementing mitigations based on risk, which includes patching as a mitigation option. E8-PA-ML1.6 is a specific mitigation/timeliness requirement for a specific asset class, whereas ISM-1163 covers broader monitoring, testing, analysis and risk-based treatment across systems.
This control partially overlaps ISM-1483.
E8-PA-ML1.6 requires applying non-critical security patches for online services within two weeks when vendors rate them non-critical and no working exploits exist. ISM-1483 supports this outcome by requiring the latest release of internet-facing server applications to be used, which typically includes security fixes and reduces exposure from unpatched vulnerabilities. ISM-1483 focuses on staying current with releases (a currency/standardisation requirement), while E8-PA-ML1.6 is a time-bound patching requirement tied to vendor advisories and exploit status.
This control partially overlaps ISM-1694.
ISM-1694 requires non-critical operating system security patches for internet-facing servers and internet-facing network devices to be applied within two weeks of release when no working exploits exist. E8-PA-ML1.6 is similar in timing and conditions, but it applies to online services rather than operating systems. They overlap on the concept of timely remediation for internet-exposed attack surfaces, but differ materially in the asset class being patched (OS vs online services).
This control partially overlaps ISM-1697.
ISM-1697 requires organisations to patch non-critical driver vulnerabilities within one month where no working exploits exist. E8-PA-ML1.6 similarly requires patching of non-critical vulnerabilities with no working exploits, but for online services and within two weeks. They overlap on vulnerability-driven patching, but have different technology scope and mandated timeframes.
This control partially overlaps ISM-1876.
E8-PA-ML1.6 requires patching vulnerabilities in online services within two weeks when vendors assess them as non-critical and no working exploits exist. ISM-1876 also targets online services but mandates a much shorter 48-hour timeframe when vulnerabilities are critical or working exploits exist. They overlap on the same asset class (online services) and patching activity, but differ on severity/exploit conditions and required urgency.
This control supports ISM-0298.
E8-PA-ML1.6 requires timely application of non-critical patches for vulnerabilities in online services within two weeks when no working exploits exist. ISM-0298 supports this by requiring a centralised, managed approach that preserves patch integrity and confirms successful application, which improves reliability and auditability of patching for online services. ISM-0298 is broader across multiple asset types (applications, operating systems, drivers and firmware), whereas E8-PA-ML1.6 is specific to online services and a two-week window.
This control depends on ISM-1143.
E8-PA-ML1.6 requires organisations to apply non-critical online service patches within two weeks based on vendor criticality and exploit availability. ISM-1143 requires patch management processes and supporting procedures to be developed, implemented and maintained, which are necessary to operationalise consistent two-week patch deployment for online services. E8-PA-ML1.6 is a specific performance expectation, while ISM-1143 is the governance/process prerequisite to achieve it at scale.
This control depends on ISM-1698.
E8-PA-ML1.6 requires organisations to apply non-critical patches for vulnerabilities in online services within two weeks where no working exploits exist. ISM-1698 requires daily vulnerability scanning to identify missing patches or updates for vulnerabilities in online services, which provides the detection/visibility needed to reliably meet the two-week patching requirement. Without the capability described in ISM-1698 (or an equivalent mechanism), organisations may not consistently identify missing online-service updates in time to comply with E8-PA-ML1.6.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-06.2Apply security patches within risk-based timeframes and automate low-impact updatesPartially overlaps
This control partially overlaps IT.PRO-06.2.
IT.PRO-06.2 requires security patches or updates to be applied within defined risk-based timeframes; E8-PA-ML1.6 sets a two-week deadline for patching online services when vendors assess vulnerabilities as non-critical and no working exploits exist, one risk-based timeframe.
- IT.PRO-06.3Remediate or mitigate above-threshold vulnerabilities within defined timeframes and verify effectivenessPartially overlaps
This control partially overlaps IT.PRO-06.3.
IT.PRO-06.3 requires vulnerabilities above risk thresholds to be remediated or mitigated in set timeframes; E8-PA-ML1.6 sets two weeks to apply patches or vendor mitigations for online services when vendors rate vulnerabilities non-critical and no working exploits exist, one such timeframe.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.