Essential Eight PO-ML1.1 Automated bi-weekly asset discovery for vulnerability scanning
What it says
An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse an automated tool to find all system assets every two weeks for security checks.
This control means using a tool to automatically find all the devices, computers, and other tech assets your organisation has every two weeks. It matters because it ensures that anything with a security vulnerability can be identified and fixed before harmful attacks happen. Without this control, unknown devices could have vulnerabilities that attackers might exploit to steal information or disrupt operations.
Free. Save your status, tasks and notes.
Why it matters
Without fortnightly asset discovery, unmanaged devices can remain unseen and unscanned, leaving exploitable unpatched vulnerabilities on the network.
How to implement
The IT team should choose an automated asset discovery tool that is suited to the organisation's infrastructure by evaluating tools that can scan networks and list all connected devices.
A system administrator should configure the chosen tool to perform scans every two weeks by setting up a regular schedule within the tool's settings.
The IT manager should ensure the tool is running correctly and reviewing reports by checking completed scan logs and verifying that all expected systems are identified.
The security officer should establish a process for reviewing and investigating any unknown assets found by the scan by including this task in the regular IT security meetings.
Keep it running
Schedule automated discovery at least fortnightly; reconcile results to the asset register and ensure newly found devices are added to vulnerability scanning targets.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Can you show me how you discover new assets connected to your network?
Look at
Examine the tool's scan schedule and logs to see when the last few scans were run.
Good evidence
The tool should show scans taking place every two weeks, with up-to-date records of all assets identified.
- Check 2 of 2What an auditor asks for
Ask for
What happens if an unknown asset is found?
Look at
Check for documented procedures or logs showing follow-up actions taken for unknown assets.
Good evidence
A documented process outlines steps to investigate unknown assets, and logs show recent investigations have occurred.
Mappings
Closest match in ASD Information Security Manual: ISM-1807, Automated asset discovery for vulnerability scanning, which asks for the same thing.
ASD Information Security Manual: 9 mappings
This control is equivalent to ISM-1807.
E8-PO-ML1.1 requires an automated method of asset discovery to be run at least fortnightly so assets can be identified for subsequent vulnerability scanning. ISM-1807 states the same requirement with the same cadence and purpose (discovering assets to feed vulnerability scanning). Implementing ISM-1807 would largely satisfy E8-PO-ML1.1 without material gaps.
This control is broader than ISM-1163.
E8-PO-ML1.1 requires automated fortnightly asset discovery to ensure assets are identified for vulnerability scanning. ISM-1163 relates by mandating a broader continuous monitoring plan that includes conducting vulnerability scans at least fortnightly (plus assessments/pen tests, analysis, and risk-based mitigations). E8-PO-ML1.1 is a specific enabling activity within the wider vulnerability management lifecycle described by ISM-1163.
This control partially meets ISM-2118.
ISM-2118 requires vulnerability assessments and penetration tests to be performed before deployment and periodically thereafter. E8-PO-ML1.1 requires automated fortnightly asset discovery to support subsequent vulnerability scanning, which helps ensure the testing/scanning coverage expected by ISM-2118 is not missing unmanaged assets. E8-PO-ML1.1 is narrower because it is an enabling activity (asset discovery) and does not itself require vulnerability assessment or penetration testing.
This control supports ISM-0336.
E8-PO-ML1.1 requires automated fortnightly asset discovery to ensure vulnerability scanning can find all relevant assets. ISM-0336 requires a networked IT equipment register that is developed, maintained and verified, which provides an authoritative baseline of known equipment to reconcile against discovery results. ISM-0336 does not require automated discovery or a fortnightly cadence, but it strengthens E8-PO-ML1.1 by reducing blind spots and improving asset identification quality.
This control supports ISM-1493.
E8-PO-ML1.1 focuses on discovering assets automatically at least fortnightly to enable effective vulnerability scanning coverage. ISM-1493 requires software registers to be developed, maintained and verified, which helps identify what software exists on discovered assets and supports scoping and prioritisation for subsequent vulnerability scanning and remediation. ISM-1493 is about maintaining register accuracy rather than performing automated discovery at a defined frequency.
This control supports ISM-1696.
ISM-1696 requires critical OS patches to be applied within 48 hours for workstations and non-internet-facing servers and network devices when rated critical or exploited. E8-PO-ML1.1 requires automated asset discovery at least fortnightly to ensure assets are known for subsequent vulnerability scanning, which underpins the ability to identify where critical patches must be applied. Without asset discovery, organisations can miss unmanaged endpoints and fail to meet ISM-1696 timeframes for all in-scope systems.
This control supports ISM-1700.
ISM-1700 requires fortnightly vulnerability scanning to identify missing patches/updates for non-core applications. E8-PO-ML1.1 requires automated asset discovery at least fortnightly to identify assets for subsequent vulnerability scanning. ISM-1700 depends on accurate, up-to-date asset discovery to ensure scanning coverage is complete and the 'missing patches' results are meaningful across the environment.
This control supports ISM-1703.
ISM-1703 requires a vulnerability scanner be used at least fortnightly to identify missing driver patches or updates. E8-PO-ML1.1 mandates automated asset discovery at least fortnightly to enable subsequent vulnerability scanning. E8-PO-ML1.1 supports ISM-1703 by ensuring systems that require driver patch assessment are discovered and brought into scanning scope, but it is not a substitute for the scanning requirement itself.
This control depends on ISM-1697.
ISM-1697 requires applying non-critical driver patches within one month when no working exploits exist. E8-PO-ML1.1 supports ISM-1697 by requiring automated asset discovery to feed vulnerability scanning, helping ensure devices with vulnerable drivers are in scope for patch tracking and remediation. The candidate control is foundational for coverage, but it does not itself require patch deployment within a defined window.
ASD Essentials for enterprise IT: 3 mappings
- IT.DET-05.1Periodically review detection coverage for gaps as assets, services and architecture changePartially overlaps
This control partially overlaps IT.DET-05.1.
IT.DET-05.1 requires periodic reviews of detection coverage to find gaps from new assets, services or architectural changes; E8-PO-ML1.1 requires automated asset discovery at least fortnightly for vulnerability scanning, which can also surface new assets for that coverage review.
- IT.IDE-01.1Use an approved inventory with automated discovery of new and changed assetsPartially overlaps
This control partially overlaps IT.IDE-01.1.
IT.IDE-01.1 requires an approved asset inventory mechanism with automated discovery of new and changed physical and non-physical assets; E8-PO-ML1.1 sets a minimum frequency for that discovery, at least fortnightly, to detect assets for subsequent vulnerability scanning.
- IT.PRO-06.1Continuously scan and assess assets for known software and configuration weaknessesPartially overlaps
This control partially overlaps IT.PRO-06.1.
IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to identify known software and configuration weaknesses; E8-PO-ML1.1 supports it by requiring automated asset discovery at least fortnightly to detect assets for subsequent scanning.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.