Skip to content
Patch applications
Essential EightE8-PA-ML2.1

Essential Eight PA-ML2.1 Fortnightly vulnerability scanning for non-core applications

What it says

A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF software, and security products.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Use a vulnerability scanner every two weeks to find missing patches in non-core applications.

This control is about regularly checking less critical applications, which aren't part of the typical office suite, for security gaps or vulnerabilities every two weeks. It's important because if these applications aren't updated, hackers could exploit weaknesses in them to access sensitive information or disrupt operations, even though they're not as commonly targeted as core applications.

Why it matters

Without fortnightly scanning, unpatched non-core applications can harbour known vulnerabilities, enabling initial access, data theft, or disruption.

How to implement

  1. The system administrator should run vulnerability scans on all non-core applications every two weeks.

    Use a trusted vulnerability scanning tool to automate this process.

  2. The IT team should ensure the vulnerability scanner's database is kept up to date.

    Regularly check for database updates and apply them promptly to identify the latest threats.

  3. The security officer should review scan results to identify missing patches or updates.

    Analyse the results and prioritise patches based on the severity of vulnerabilities found.

  4. The IT team should document the scanning process and results.

    Maintain a record of scan dates, the applications scanned, and the actions taken in response to any vulnerabilities found.

Keep it running

Run vulnerability scans at least fortnightly across all non-core applications; track findings, validate coverage, and prioritise patching by severity and exposure.

Evidence and audit

  1. Check 1 of 2What an auditor asks for

    Ask for

    How often are vulnerability scans conducted on non-core applications?

    Look at

    Examine the vulnerability scanning schedule and logs for regular scans.

    Good evidence

    Evidence shows scans are conducted every two weeks, and records indicate consistent coverage of non-core applications.

  2. Check 2 of 2What an auditor asks for

    Ask for

    Is the vulnerability database updated regularly?

    Look at

    Check logs or records of the update history for the vulnerability scanner.

    Good evidence

    Logs confirm the vulnerability database is updated at least within 24 hours before each scan.

Mappings

Closest match in ASD Information Security Manual: ISM-1700, Regular vulnerability scanning for applications, which asks for the same thing.

ASD ISM

ASD Information Security Manual: 6 mappings

  • ISM-1700Regular vulnerability scanning for applicationsEquivalent
  • ISM-2118Conduct vulnerability assessments and penetration testsPartially meets
  • ISM-1693Timely application of patches to mitigate vulnerabilitiesPartially overlaps
  • ISM-1699Weekly vulnerability scanning for software updatesPartially overlaps
  • ISM-1703Regular vulnerability scanning for missing patchesPartially overlaps
  • ISM-0298Centralised system patch and update managementSupports
ASD Essentials

ASD Essentials for enterprise IT: 1 mapping

  • IT.PRO-06.1Continuously scan and assess assets for known software and configuration weaknessesPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.