Essential Eight PA-ML3.1 Patch critical vulnerabilities in applications within 48 hours

This control partially meets A.8.8.

E8-PA-ML3.1 requires obtaining and applying vendor mitigations within 48 hours for critical or exploited vulnerabilities in nominated high-risk application categories. Annex A 8.8 requires organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures across information systems generally. E8-PA-ML3.1 is a prescriptive, time-bound implementation for a specific application set within the broader vulnerability management expectation in Annex A 8.8.

This control supports A.5.7.

E8-PA-ML3.1 requires urgent patching within 48 hours when vendors rate vulnerabilities as critical or when working exploits exist for key application categories. Annex A 5.7 requires collection and analysis of threat information to produce threat intelligence, which supports identifying exploit activity and prioritising the urgent remediation events that trigger E8-PA-ML3.1. Annex A 5.7 does not mandate patch deployment timelines or specify the application classes covered by E8-PA-ML3.1.

This control is equivalent to ISM-1692.

E8-PA-ML3.1 requires patches, updates or vendor mitigations for critical or exploited vulnerabilities in office suites, browsers/extensions, email clients, PDF software, and security products to be applied within 48 hours of release. ISM-1692 states the same software scope, the same criticality/exploitation triggers, and the same 48-hour timeframe. Implementing ISM-1692 would largely satisfy E8-PA-ML3.1 as written.

This control partially meets ISM-1143.

E8-PA-ML3.1 requires a 48-hour remediation outcome for critical or exploited vulnerabilities in a defined set of high-risk applications. ISM-1143 requires patch management processes and procedures to be developed, implemented and maintained, which supports the operational capability (intake, triage, testing, deployment, and exception handling) needed to consistently meet and evidence the 48-hour application patching SLA. ISM-1143 is procedural/governance-focused and does not specify the application categories or the 48-hour critical/exploited trigger set by E8-PA-ML3.1.

This control partially meets ISM-1163.

E8-PA-ML3.1 requires organisations to rapidly remediate critical/exploited vulnerabilities in key applications within 48 hours of release. ISM-1163 supports this by requiring continuous monitoring activities (regular scanning, assessment and analysis) that help identify and prioritise vulnerabilities needing urgent patching. ISM-1163 is broader risk and assurance activity and does not itself impose the specific 48-hour patching timeframe for the specified application set.

This control partially meets ISM-1754.

ISM-1754 requires vulnerabilities identified in software to be resolved in a timely manner. E8-PA-ML3.1 specifies applying critical patches within 48 hours for common applications (e.g. browsers, email clients, PDF software and security products), which is a direct subset of timely vulnerability resolution under ISM-1754. The candidate is narrower because it defines a specific timeframe and a specific application set.

This control partially overlaps ISM-1366.

ISM-1366 requires security updates to be applied to mobile devices as soon as they become available. E8-PA-ML3.1 overlaps by mandating rapid patching (within 48 hours) for critical vulnerabilities in key application classes, which can include mobile applications where those products are in scope. However, ISM-1366 is device-specific and applies to all mobile device security updates (including OS and platform updates), while E8-PA-ML3.1 is application-category and severity/conditions driven rather than "as soon as available".

This control partially overlaps ISM-1467.

ISM-1467 requires organisations to use the latest releases of key user applications and security products to reduce exposure to known weaknesses. E8-PA-ML3.1 relates by requiring very rapid application of patches/mitigations (within 48 hours) for critical or exploited vulnerabilities in those same product categories. ISM-1467 is about staying current as a standing state, while E8-PA-ML3.1 is an emergency/priority patching requirement that can apply even when an organisation is not upgrading to the latest release.

This control partially overlaps ISM-1691.

ISM-1691 mandates applying patches for key end-user software (e.g. browsers, email clients, PDF apps, security products) within two weeks of release. E8-PA-ML3.1 covers the same software categories but tightens the requirement to patch within 48 hours when vulnerabilities are critical or working exploits exist. The overlap is the shared software scope and patching intent, while the candidate introduces a stricter, risk-triggered SLA not expressed in ISM-1691.

This control partially overlaps ISM-1901.

E8-PA-ML3.1 requires applying mitigations within 48 hours for critical or exploited vulnerabilities in specific end-user application categories and security products. ISM-1901 addresses the same application categories but sets a two-week timeframe when vulnerabilities are non-critical and have no working exploits. The controls overlap on patching the same application set, but differ fundamentally on the urgency trigger (critical/exploited vs non-critical/no exploit) and required remediation timeline.

This control supports ISM-0298.

E8-PA-ML3.1 requires rapid deployment of patches/mitigations within 48 hours for critical or exploited vulnerabilities in high-risk end-user applications and security products. ISM-0298 requires a centralised, managed patching approach that maintains patch integrity and confirms successful application, which supports the speed and assurance required to reliably deliver and prove the 48-hour application patching outcome. ISM-0298 is broader across technology types (applications, operating systems, drivers, firmware) and is enablement-focused rather than prescribing the E8-specific urgency trigger and scope.

This control supports ISM-1921.

ISM-1921 requires organisations to frequently assess the likelihood of system compromise when working exploits exist for unmitigated vulnerabilities. E8-PA-ML3.1 supports ISM-1921 by setting an urgent patch/mitigation expectation for exploited or vendor-critical application vulnerabilities, which should trigger repeated compromise-likelihood reassessment for affected endpoints and services until mitigated. E8-PA-ML3.1 prescribes treatment timeframes for a defined application set, while ISM-1921 is broader and focuses on the assessment cadence and decision-making driven by exploitability.

This control depends on ISM-1699.

E8-PA-ML3.1 requires organisations to deploy vendor mitigations within 48 hours for critical or exploited vulnerabilities in specified application categories and security products. ISM-1699 requires weekly vulnerability scanning to identify missing patches for those same application categories, which supports timely detection, verification, and reporting of whether the 48-hour patching target is being met. ISM-1699 strengthens assurance and prioritisation for E8-PA-ML3.1 but does not itself mandate the 48-hour remediation action.

This control partially overlaps IT.PRO-06.2.

IT.PRO-06.2 requires security patches or updates to be applied within defined risk-based timeframes; E8-PA-ML3.1 is one case: a 48-hour deadline for office, browser, email, PDF and security software when vendors assess vulnerabilities as critical or working exploits exist.

This control partially overlaps IT.PRO-06.3.

IT.PRO-06.3 requires vulnerabilities above risk thresholds to be remediated or mitigated in set timeframes; E8-PA-ML3.1 sets 48 hours to patch office suites, browsers and extensions, email clients, PDF and security software when vendors rate vulnerabilities critical or working exploits exist, one such timeframe.