Essential Eight PA-ML1.7Patch office, browser, email, PDF and security software within two weeks
Official control statement
Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products are applied within two weeks of release.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Apply vendor fixes for known flaws in office apps, browsers and their extensions, email apps, PDF software and security tools within two weeks of release, so attackers have less time to use them.
What this means in practice
This control sets a deadline for fixing known security flaws in five kinds of software: office productivity suites (such as word processing, spreadsheet and presentation applications), web browsers and the extensions installed in them, email clients, PDF software (such as PDF readers and editors), and security products such as antivirus or endpoint protection tools. Whenever a vendor releases a patch, an update or another mitigation (such as a recommended setting change or workaround) for a vulnerability in one of these products, it must be applied within two weeks of that release. The two weeks start when the vendor releases the fix, not when the organisation notices or approves it, and the fix only counts once it is actually in place on each installation, not when it has merely been downloaded or scheduled. This matters because most of these applications handle content from outside the organisation every day, such as web pages, emails, attachments and documents, so an unfixed flaw can let an attacker run malicious code on a device just because someone opened a file or visited a website. Security products usually run with deep access to the devices they protect, so a flaw in one can give an attacker significant control or a way to switch protection off. Once a fix is published, the weakness is public knowledge and attackers can work out how to exploit it, so every day an available fix goes unapplied lengthens the time a known, fixable weakness can be used against the organisation.
Framework
ASD Essential Eight
Control effect (Control Stack)
Preventative
E8 mitigation strategy
Patch applications
Classifications
N/A
Official last update
N/A
Control Stack last updated
15 Oct 2026
E8 maturity levels
N/A
Why it matters
If these fixes are not applied within two weeks of release, the organisation keeps running office suites, browsers and their extensions, email clients, PDF software and security products with publicly known vulnerabilities, and attackers can reach those flaws through ordinary activity: a user visiting a malicious or compromised website, opening a crafted email, attachment, document or PDF, or loading a web page that exploits a vulnerable browser extension. A successful exploit can let an attacker run code on the device, steal credentials and data, install ransomware or other malware and use that foothold to move further into the network, while a vulnerable security product can be exploited or disabled, removing protection the organisation relies on. Fixes left past the deadline also build into a backlog of exposed installations that is harder to clear and leaves the organisation unable to show it meets this requirement.
Operational notes
Run this as a continuous routine rather than a periodic patching event. Every new vendor release for an in-scope product starts its own two-week deadline, and browsers, browser extensions and security products often release fixes on their own schedules, outside any regular monthly patch cycle. Keep automatic updating switched on and working wherever a product supports it, monitor vendor release notes and security advisories for every in-scope product so each new fix is logged with its release date, and deploy anything that does not update itself through the patch or device management tool early enough to finish inside the window.
Well before each deadline, use patch deployment or vulnerability scan reports to find installations still running an older version, and follow up the usual stragglers: laptops that rarely connect, failed installations, applications waiting on a restart that users keep postponing, and shared or virtual desktops and servers where these products are also installed. When a vendor issues a mitigation rather than a patch, apply it to every affected installation within the same two weeks, then apply the eventual patch within two weeks of its own release. Keep a record of each vendor release date and the date each fix was fully applied, so meeting the timeframe can be shown at any time.
Implementation tips
- The IT asset or desktop management lead should keep an up-to-date register of the office productivity suites, web browsers and their extensions, email clients, PDF software and security products in use, recording the vendor, the installed versions, where each is installed (including laptops, shared or virtual desktops and any servers) and how it receives updates. Populate it from the device management or software inventory tool, and use browser management policies or reports to list installed extensions, because extensions update separately from the browser itself.
- The patch management lead should subscribe to the security advisories and release notes of every vendor on the register and log each new patch, update or vendor mitigation in a patch tracker or ticketing system with its vendor release date, a due date two weeks after that release and an owner. Measuring every due date from the vendor's release, rather than from when the team noticed or approved the fix, keeps the tracker aligned to the two-week deadline.
- Endpoint administrators should turn on and enforce automatic updating for each in-scope product wherever it is supported (browser and extension auto-update policies, an office suite update channel that delivers security fixes in time to meet the two-week window, automatic email client and PDF software updates, and the security product's own update service), and prevent users from switching it off. Configure browsers and other applications to prompt for, and then force, a restart after an update installs so the fixed version is actually running within the two weeks.
- Where a product cannot update itself, desktop or server administrators should package and deploy each fix through the organisation's patch or device management tool, timing pilot and deployment rings so the last ring finishes well before the two-week deadline. When a vendor releases a mitigation instead of, or ahead of, a patch (such as a configuration change or disabling a vulnerable feature), push it to every affected installation the same way within two weeks of its release, record what was changed, and when the vendor later releases a patch, deploy it within two weeks of that release.
- The patch management lead should run a deployment or vulnerability scan report for each open fix before its due date, list the devices and installations still on an older version, and have the owners resolve each one, for example by reconnecting and updating offline laptops, fixing failed installations and forcing pending restarts. Record the date each fix was fully applied, and report any fix that missed its two-week deadline to IT management with the cause and the corrective action taken.
Audit / evidence tips
- AskAsk for the register or inventory of office productivity suites, web browsers and their extensions, email clients, PDF software and security products in use, with the versions installed on each device.Look atWhether any of these product types is missing, particularly browser extensions and security products, and whether rarely connected laptops, shared or virtual desktops and servers running these products are left out.GoodEvery in-scope product and extension is recorded wherever it is installed, so no installation sits outside the patching process.
- AskAsk for a sample of patches, updates and vendor mitigations released for in-scope products over recent months, with each vendor release date and the date the fix was applied across all affected installations.Look atWhether the time from the vendor's release to full deployment exceeded two weeks, and whether the organisation measured from its own approval or scheduling date instead of the vendor's release date.GoodEvery sampled fix was applied to all affected installations within two weeks of the vendor's release.
- AskAsk for a current patch compliance or vulnerability scan report for devices running in-scope software, and pick several devices to compare against the vendors' latest releases.Look atInstallations still running a version older than a fix released more than two weeks ago, including browser extensions, security product agents and applications waiting on a restart to finish updating.GoodNo device is running an in-scope product or extension that is missing a fix released more than two weeks earlier.
- AskAsk for any recent case where a vendor released a mitigation for an in-scope product, such as a configuration change or workaround, rather than a patch, and the records of how it was applied.Look atWhether the mitigation reached every affected installation within two weeks of the vendor's release, and whether the later patch was then applied within two weeks of its own release.GoodVendor mitigations are tracked and applied to the same two-week deadline as patches and updates, with records of what was changed, where and when.
- AskAsk for the update settings for each in-scope product, such as browser and extension update policies, the office suite update channel and the security product's update configuration, together with the deployment schedule for products updated through the patch management tool.Look atWhether automatic updates are disabled, deferred or left to users, whether deployment rings are timed to finish inside two weeks, and whether updates can sit waiting for a restart indefinitely.GoodUpdate settings and deployment schedules for every in-scope product are designed so fixes are installed and running within two weeks of release.
Cross-framework mappings
How E8-PA-ML1.7 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.8 | ISO/IEC 27001:2022 Annex A 8.8 requires an organisation to obtain information about technical vulnerabilities in its information systems,... | |
ASD ISM
| Control | Notes | Details |
|---|---|---|
equalEquivalent(1)expand_less | ||
| ISM-1691 | E8-PA-ML1.7 and ISM-1691 both require patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web... | |
open_in_fullBroader than(1)expand_less | ||
| ISM-1901 | E8-PA-ML1.7 requires patches for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF sof... | |
layersPartially meets(1)expand_less | ||
| ISM-1754 | ISM-1754 requires vulnerabilities identified in software to be resolved in a timely manner, without naming particular software or a timef... | |
sync_altPartially overlaps(2)expand_less | ||
| ISM-1467 | E8-PA-ML1.7 requires patches, updates or other vendor mitigations for office productivity suites, web browsers and their extensions, emai... | |
| ISM-1692 | E8-PA-ML1.7 requires patches for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF sof... | |
extensionDepends on(3)expand_less | ||
| ISM-0298 | ISM-0298 requires a centralised and managed approach, which maintains patch integrity and confirms successful installation, to be used to... | |
| ISM-1143 | ISM-1143 requires patch management processes and supporting procedures to be developed, implemented and maintained, while E8-PA-ML1.7 req... | |
| ISM-1699 | ISM-1699 requires a vulnerability scanner to be used at least weekly to find missing patches or updates in office productivity suites, we... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related Essential 8 controls in Patch applications
See all Patch applications controls, or browse the full ASD Essential Eight library.