Essential Eight PA-ML3.2 Apply patches for non-critical vulnerabilities within two weeks
What it says
Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure software patches for non-critical flaws are installed within two weeks if no exploits exist.
This control means you should make sure any updates to fix non-critical issues in your software are applied within two weeks, as long as there are no known threats exploiting these issues. It's important because it helps prevent potential vulnerabilities from being used by cyber attackers to access or damage your systems.
Free. Save your status, tasks and notes.
Why it matters
If non-critical vendor-rated patches for browsers, email, PDF, office and security tools aren't applied within two weeks, known flaws may be weaponised and enable compromise.
How to implement
IT Team: Identify all software applications used in the organisation by maintaining an up-to-date inventory list of all installed applications.
Confirm this list regularly.
System Administrator: Monitor software vendors' announcements for newly released patches and updates.
Check vendor websites or subscribe to their mailing lists to receive notifications.
Security Officer: Set up a system to track which vulnerabilities are non-critical and ensure patches are applied within two weeks.
Use a simple spreadsheet or a dedicated patch management tool for tracking.
IT Team: Schedule regular updates to be installed automatically or manually within the specified timeframe.
Use organisational policies to automate the update processes where possible.
Keep it running
Track vendor advisories for browsers, email, PDF, office and security products; confirm issues are non-critical with no working exploits, then deploy updates within 14 days.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How does your organisation keep track of updates and patches released for software applications?
Look at
Examine the inventory list of installed software and patch records detailing updates applied.
Good evidence
The organisation has a comprehensive list of applications with clear records showing patches applied within two weeks of release for non-critical vulnerabilities.
- Check 2 of 2What an auditor asks for
Ask for
What process is followed to determine the criticality of a vulnerability and the existence of exploits?
Look at
Review documentation on the assessment of announced vulnerabilities and any correspondence with software vendors.
Good evidence
There are documented processes, aligned with vendor guidance, that assess vulnerability criticality and apply patches accordingly.
Mappings
Closest match in ASD Information Security Manual: ISM-1901, Timely application of non-critical security patches, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
E8-PA-ML3.2 mandates a two-week patching timeframe for non-critical vulnerabilities in specific high-risk applications. Annex A 8.8 requires organisations to address technical vulnerabilities generally, typically involving patching. E8-PA-ML3.2 is a more prescriptive subset with explicit scope and conditions.
ASD Information Security Manual: 7 mappings
This control is equivalent to ISM-1901.
E8-PA-ML3.2 requires patches for non-critical vulnerabilities in office suites, browsers, email clients, PDF software, and security products to be applied within two weeks when no working exploits exist. ISM-1901 mirrors these conditions, software scope, and timeframe. Implementing either largely satisfies the other.
This control partially meets ISM-1754.
E8-PA-ML3.2 mandates timely patching of non-critical vulnerabilities in specified user applications within two weeks when no exploits exist. ISM-1754 requires timely resolution of vulnerabilities in software, encompassing broader remediation options. E8-PA-ML3.2 is more specific and measurable.
This control partially overlaps ISM-1467.
ISM-1467 requires organisations to use the latest releases of core user applications (office suites, browsers and extensions, email clients, PDF software, and security products). E8-PA-ML3.2 relates by setting a patch/update timeliness requirement (within two weeks) for non-critical vulnerabilities in those same application categories, which is one mechanism to maintain currency. ISM-1467 is version-focused (latest release), whereas E8-PA-ML3.2 is vulnerability/patch-cycle focused and can be met without always being on the absolute latest major release.
This control partially overlaps ISM-1691.
ISM-1691 requires patches, updates or vendor mitigations for vulnerabilities in office productivity suites, web browsers and extensions, email clients, PDF applications, and security products to be applied within two weeks of release. E8-PA-ML3.2 aligns to this same software scope and two-week timeframe, but only when vendors assess vulnerabilities as non-critical and no working exploits exist. ISM-1691 does not include the candidate's conditionality around severity/exploitability, making the requirements only partially aligned rather than identical.
This control partially overlaps ISM-1692.
E8-PA-ML3.2 requires organisations to apply patches for non-critical vulnerabilities in common user applications and security products within two weeks where no working exploits exist. ISM-1692 covers the same application/product classes but for critical vulnerabilities or working exploits, within 48 hours. They align on patch-management objectives but differ in risk conditions and urgency.
This control partially overlaps ISM-1693.
E8-PA-ML3.2 requires patching within two weeks for non-critical vulnerabilities (with no working exploits) in a specific set of user-facing and security applications. ISM-1693 requires patching within one month for vulnerabilities in other applications outside that specified set. They both address timely patching, but apply to different software scopes and use different timeframes, so the alignment is only partial.
This control depends on ISM-1643.
E8-PA-ML3.2 needs organisations to patch specified applications within two weeks for non-critical vulnerabilities. ISM-1643 enables this by requiring records of software versions and patch histories, allowing organisations to track and evidence compliance with E8-PA-ML3.2.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-06.2Apply security patches within risk-based timeframes and automate low-impact updatesPartially overlaps
This control partially overlaps IT.PRO-06.2.
IT.PRO-06.2 requires security patches to be applied within risk-based timeframes; E8-PA-ML3.2 sets two weeks to patch office suites, browsers and extensions, email clients, PDF and security software when vendors rate vulnerabilities non-critical and no working exploits exist, one specific case.
- IT.PRO-06.3Remediate or mitigate above-threshold vulnerabilities within defined timeframes and verify effectivenessPartially overlaps
This control partially overlaps IT.PRO-06.3.
IT.PRO-06.3 requires vulnerabilities above risk thresholds to be remediated or mitigated in set timeframes; E8-PA-ML3.2 sets two weeks to patch office suites, browsers and extensions, email clients, PDF and security software when vendors rate vulnerabilities non-critical and no working exploits exist, one such timeframe.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.