Essential Eight PA-ML2.2 Timely patching of non-critical application vulnerabilities
What it says
Patches, updates or other vendor mitigations for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF software, and security products are applied within one month of release.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishApply patches for non-critical apps within a month to fix vulnerabilities.
This control is about making sure that all the software you use, like accounting tools or any specialised apps, are regularly updated to patch up any security holes. Imagine leaving your house door unlocked; if your software isn't patched, it's like leaving a window open for cyber criminals to sneak in. Getting your software updated in a timely manner stops hacks before they even start.
Free. Save your status, tasks and notes.
Why it matters
Delaying patches for non-critical applications beyond one month leaves known flaws exploitable and increases the chance of system compromise or data theft.
How to implement
The IT team should track all the applications that are not critical, like inventory management or scheduling software, by maintaining a detailed software inventory.
A system administrator should regularly check for updates from the software vendors by visiting their official websites or setting up alerts for new releases.
The IT team should schedule a routine, like the first Friday of every month, to apply the latest patches to non-critical applications that have been released in the past month.
The security officer should create a calendar reminder or notification system that prompts the IT team to review and apply necessary patches monthly.
The IT team should test patches on a non-critical environment first to ensure they don't disrupt operations, making adjustments as required.
Keep it running
Maintain an inventory of non-critical apps, monitor vendor advisories, and schedule deployment so patches/mitigations are applied within one month of release.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How do you ensure that all non-critical applications are updated within a month of patch release?
Look at
Examine the schedule of patch applications and maintenance logs for evidence of timely updates.
Good evidence
A maintained schedule showing regular checks and updates within a month, with logs showing specific dates and applications patched.
- Check 2 of 2What an auditor asks for
Ask for
Can you show how you track available patches from vendors for non-critical applications?
Look at
Inspect vendor alerts or subscription notifications that inform the team about new patches.
Good evidence
Subscriptions to vendor notifications or alerts, with an evidence log of when they were reviewed or acted upon.
Mappings
Closest match in ASD Information Security Manual: ISM-1693, Timely application of patches to mitigate vulnerabilities, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
E8-PA-ML2.2 requires organisations to remediate vulnerabilities in certain non-critical applications by applying patches/mitigations within one month of release. ISO/IEC 27001:2022 Annex A 8.8 is broader, requiring organisations to obtain information about technical vulnerabilities, assess exposure, and take appropriate measures across information systems in use. E8-PA-ML2.2 is a specific, time-bound treatment measure within the wider vulnerability management expectations of Annex A 8.8.
ASD Information Security Manual: 8 mappings
This control is equivalent to ISM-1693.
E8-PA-ML2.2 requires patches, updates or vendor mitigations for vulnerabilities in non-critical applications (excluding productivity suites, browsers, email clients, PDF software and security products) to be applied within one month of release. ISM-1693 states the same patching requirement for the same application scope and the same one-month timeframe. The two controls are effectively the same obligation expressed in different frameworks.
This control partially overlaps ISM-0304.
ISM-0304 requires organisations to remove applications that are no longer supported by vendors (outside the listed key application categories). E8-PA-ML2.2 focuses on applying patches/updates/mitigations for vulnerabilities in those non-core applications within one month of release, which assumes the software remains in use and supported. They overlap in managing security risk from non-core applications, but ISM-0304 mandates removal when support ends while E8-PA-ML2.2 mandates timely patching while support exists.
This control partially overlaps ISM-1163.
E8-PA-ML2.2 requires timely remediation by applying patches/mitigations for non-critical applications within one month of release. ISM-1163 overlaps by requiring continuous monitoring activities (including vulnerability scanning, assessment and analysis) and implementing mitigations based on risk, which includes patching as one mitigation option. ISM-1163 is broader and risk-driven (covers many vulnerability identification and treatment activities), while E8-PA-ML2.2 mandates a specific patching timeframe for a defined application subset.
This control partially overlaps ISM-1606.
E8-PA-ML2.2 requires patching of non-critical applications within one month of release. ISM-1606 overlaps by requiring timely patching/mitigation of vulnerabilities for isolation mechanisms and underlying operating systems in virtualised environments, which is also a form of timely vulnerability remediation. ISM-1606 is scoped to virtualisation components and does not specify the same one-month SLA or the same application category focus as E8-PA-ML2.2.
This control depends on ISM-0298.
E8-PA-ML2.2 requires patches, updates or other mitigations for vulnerabilities in non-critical applications to be applied within one month of release. ISM-0298 is a prerequisite enabler by requiring a centralised, managed approach to deliver patches/updates with integrity and confirmation of successful application. Without the capabilities in ISM-0298, consistently meeting the one-month patch timeframe in E8-PA-ML2.2 is significantly harder to assure at scale.
This control depends on ISM-1143.
E8-PA-ML2.2 requires timely application of patches/mitigations for non-critical applications within one month. ISM-1143 is a prerequisite by requiring patch management processes and procedures to be developed, implemented and maintained to drive consistent patch identification, testing, scheduling and deployment. ISM-1143 is broader (governance and process), while E8-PA-ML2.2 sets a specific patching outcome and timeframe.
This control depends on ISM-1643.
E8-PA-ML2.2 requires patches/mitigations for non-critical applications to be applied within one month. ISM-1643 supports E8-PA-ML2.2 by requiring software registers to capture versions and patch histories, which helps evidence patch currency and identify lagging applications. ISM-1643 focuses on record-keeping and traceability, whereas E8-PA-ML2.2 is an implementation timeframe requirement.
This control depends on ISM-1700.
E8-PA-ML2.2 requires organisations to apply vendor patches/mitigations for vulnerabilities in non-critical applications within one month. ISM-1700 supports E8-PA-ML2.2 by requiring fortnightly vulnerability scanning to identify missing patches/updates for the same application category. ISM-1700 focuses on detection and verification, while E8-PA-ML2.2 focuses on the remediation timeframe.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-06.2Apply security patches within risk-based timeframes and automate low-impact updatesPartially overlaps
This control partially overlaps IT.PRO-06.2.
IT.PRO-06.2 requires security patches or updates to be applied within defined risk-based timeframes; E8-PA-ML2.2 sets a one-month deadline for patching applications other than office, browser, email, PDF and security software, one specific case of that.
- IT.PRO-06.3Remediate or mitigate above-threshold vulnerabilities within defined timeframes and verify effectivenessPartially overlaps
This control partially overlaps IT.PRO-06.3.
IT.PRO-06.3 requires vulnerabilities above risk thresholds to be remediated or mitigated in set timeframes; E8-PA-ML2.2 sets one month to patch applications other than office suites, browsers and extensions, email clients, PDF and security software, one such timeframe.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.