Essential Eight PO-ML1.2 Use a vulnerability scanner with an updated database

This control is equivalent to ISM-1808.

E8-PO-ML1.2 requires that vulnerability scanning activities use a vulnerability scanner with an up-to-date vulnerability database. ISM-1808 states the same requirement: a vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities. The scope and intent align closely, with both controls focusing on ensuring scanner intelligence is current rather than prescribing scanning frequency or remediation actions.

This control partially meets ISM-1699.

E8-PO-ML1.2 requires that vulnerability scanning activities use a vulnerability scanner with an up-to-date vulnerability database. ISM-1699 expands this into a specific practice by requiring at least weekly scanning for missing patches/updates across common applications (browsers, office suites, email clients, PDF apps, security products), where current scanner signatures are necessary to detect known issues. ISM-1699 is broader due to its prescribed frequency and defined software scope, while E8-PO-ML1.2 addresses only the updated-database requirement.

This control supports ISM-1696.

ISM-1696 requires rapid application of critical OS patches within 48 hours for specified non-internet-facing systems and workstations based on vendor criticality or working exploits. E8-PO-ML1.2 requires using a vulnerability scanner with an up-to-date database, which is a prerequisite capability to accurately identify and prioritise missing critical patches and known exploited vulnerabilities. While ISM-1696 is about patch deployment, it is dependent on reliable, current vulnerability intelligence/tooling like E8-PO-ML1.2 to drive timely action and provide assurance coverage.

This control supports ISM-1697.

ISM-1697 requires organisations to apply non-critical driver patches within one month where no working exploits exist. E8-PO-ML1.2 supports ISM-1697 by requiring vulnerability scanning with an up-to-date database, which helps identify missing patches/updates and validate remediation status for components such as drivers. The scanning requirement is complementary but does not define the driver patching timeframe or conditions itself.

This control supports ISM-1698.

E8-PO-ML1.2 requires using a vulnerability scanner with an up-to-date vulnerability database for scanning activities. ISM-1698 mandates at least daily scanning to identify missing patches/updates for online services, and achieving reliable daily detection is strengthened by the primary requirement for current vulnerability data. ISM-1698 adds prescriptive frequency and a specific use case (online services) that E8-PO-ML1.2 does not cover.

This control supports ISM-1701.

E8-PO-ML1.2 requires use of a vulnerability scanner with an up-to-date vulnerability database for scanning activities. ISM-1701 mandates at least daily scanning for missing patches/updates on internet-facing servers and network devices. Current vulnerability data is necessary to detect newly disclosed issues on exposed systems. ISM-1701 is more prescriptive about frequency and targets, whereas E8-PO-ML1.2 is a foundational tool-quality requirement.

This control supports ISM-1702.

ISM-1702 requires organisations to use a vulnerability scanner at least fortnightly to identify missing operating system patches on specified non-internet-facing assets. E8-PO-ML1.2 requires that vulnerability scanning activities use a scanner with an up-to-date vulnerability database. ISM-1702 is dependent on E8-PO-ML1.2 in practice because the required scanning for missing patches is not reliable or meaningful without current vulnerability/signature content.

This control supports ISM-1752.

E8-PO-ML1.2 requires that vulnerability scanning uses a scanner with an up-to-date vulnerability database. ISM-1752 requires at least fortnightly scanning to identify missing patches/updates in operating systems for IT equipment other than workstations, servers, and network devices, and accurate identification depends on current vulnerability signatures and data. ISM-1752 defines frequency and a particular scope of equipment that E8-PO-ML1.2 does not specify.

This control supports ISM-1879.

ISM-1879 requires organisations to apply critical driver patches or mitigations within 48 hours when vendor-critical or exploited, which presumes the organisation can reliably identify relevant driver vulnerabilities and missing patches. E8-PO-ML1.2 requires using a vulnerability scanner with an up-to-date database, enabling accurate identification of vulnerabilities and missing updates that must be remediated to meet ISM-1879 timeframes. Without up-to-date scanning intelligence, meeting a strict 48-hour driver patch SLA is significantly hindered.

This control depends on ISM-1900.

ISM-1900 requires using a vulnerability scanner at least fortnightly to identify missing firmware patches or updates. E8-PO-ML1.2 requires that the vulnerability scanner used has an up-to-date vulnerability database, which is necessary for accurate identification of missing patches and known firmware vulnerabilities. In practice, ISM-1900 depends on E8-PO-ML1.2 to ensure scanning results are current and trustworthy.

This control partially overlaps IT.PRO-06.1.

IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to identify known software and configuration weaknesses; E8-PO-ML1.2 requires the scanner to have an up-to-date vulnerability database, so that scanning works from current data.