Essential Eight PO-ML1.3 Use a daily vulnerability scanner for internet-facing systems
What it says
A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse a tool every day to find and fix missing updates on servers and network devices facing the internet.
This control means using a tool every day to check your internet-facing systems, like websites and email servers, for any updates that are missing. This matters because if you don't keep these systems updated, hackers can find weaknesses and exploit them, putting your organisation at risk.
Free. Save your status, tasks and notes.
Why it matters
Ignoring daily scans on internet-facing systems can leave exploitable vulnerabilities unpatched, giving attackers an easy entry point soon after new flaws or updates are disclosed.
How to implement
IT team: Schedule a daily routine to run a vulnerability scanner on all internet-facing systems.
Use tools like Nessus or Qualys to perform the scans effortlessly.
System administrator: Ensure the vulnerability scanner software is always up-to-date.
Set it to automatically download the latest vulnerability database updates.
Security officer: Review the daily scan reports and identify which systems have missing patches.
Then, prioritise these systems based on the severity of vulnerabilities found.
IT team lead: Assign responsibility among team members to monitor scan results daily and initiate the patching process for critical vulnerabilities immediately.
Keep it running
Schedule daily scans for all internet-facing servers and network devices, validate scan completion, and triage findings quickly to prioritise patching of critical OS vulnerabilities.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How often are vulnerability scans conducted on internet-facing systems?
Look at
Request logs of recent scanning activities and verify the frequency.
Good evidence
The logs should show that scans are being conducted at least once daily.
- Check 2 of 2What an auditor asks for
Ask for
Is the vulnerability database used for scans kept up-to-date?
Look at
Check the timestamp of the last update of the vulnerability database.
Good evidence
The database should be updated within 24 hours prior to the scan being performed.
Mappings
Closest match in ASD Information Security Manual: ISM-1701, Daily vulnerability scanning for internet-facing systems, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
E8-PO-ML1.3 requires a specific practice: daily vulnerability scanning to identify missing OS patches/updates on internet-facing servers and internet-facing network devices. ISO/IEC 27001:2022 Annex A 8.8 requires organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures, without prescribing scanning frequency or limiting scope to internet-facing infrastructure. E8-PO-ML1.3 is a concrete implementation approach that fits within the broader vulnerability management expectations of Annex A 8.8.
ASD Information Security Manual: 11 mappings
This control is equivalent to ISM-1701.
E8-PO-ML1.3 requires a vulnerability scanner to be used at least daily to identify missing patches or updates in operating systems of internet-facing servers and internet-facing network devices. ISM-1701 states the same requirement with the same scope (internet-facing servers and network devices) and the same cadence (daily) for identifying missing OS patches/updates. Implementing ISM-1701 would largely satisfy E8-PO-ML1.3 and vice versa.
This control partially meets ISM-1163.
E8-PO-ML1.3 requires daily vulnerability scanning of internet-facing servers and network devices to identify missing OS patches or updates. ISM-1163 is broader, requiring a continuous monitoring plan, with at least fortnightly scanning, plus periodic and event-driven vulnerability assessments. E8-PO-ML1.3 fits within ISM-1163 as a specific scanning practice with a narrower focus and higher cadence.
This control partially overlaps ISM-1698.
E8-PO-ML1.3 requires daily vulnerability scanning to identify missing operating system patches or updates on internet-facing servers and internet-facing network devices. ISM-1698 mandates at least daily scanning to identify missing patches/updates, applied to 'online services', not specifically to OS on internet-facing devices. The controls overlap on daily scanning activity for externally exposed assets, but differ in asset definition and scope.
This control partially overlaps ISM-1702.
ISM-1702 requires fortnightly vulnerability scanning to identify missing operating system patches on non-internet-facing workstations, servers, and network devices. E8-PO-ML1.3 also requires vulnerability scanning for missing OS patches, but it targets internet-facing servers and internet-facing network devices and sets a higher cadence (at least daily). The controls align on the scanning purpose (finding missing OS patches) but differ materially in asset exposure and required frequency.
This control partially overlaps ISM-1703.
E8-PO-ML1.3 requires daily vulnerability scanning aimed at identifying missing patches/updates for OS vulnerabilities on internet-facing servers and network devices. ISM-1703 requires at least fortnightly vulnerability scanning to identify missing patches/updates for vulnerabilities in drivers. They overlap in using vulnerability scanning to find missing updates, but differ in technical scope (OS on internet-facing infrastructure vs drivers generally) and in required frequency.
This control partially overlaps ISM-1752.
E8-PO-ML1.3 requires daily vulnerability scanning to find missing operating system patches/updates on internet-facing servers and network devices. ISM-1752 requires at least fortnightly vulnerability scanning for missing OS patches/updates, but for other categories of IT equipment (excluding workstations, servers and network devices). The controls overlap in scanning for missing OS updates, however they target different asset classes and ISM-1752 does not address the internet-facing server/network device scope of E8-PO-ML1.3.
This control partially overlaps ISM-1900.
E8-PO-ML1.3 requires daily vulnerability scanning to identify missing operating system patches/updates on internet-facing servers and network devices. ISM-1900 requires at least fortnightly vulnerability scanning to identify missing patches/updates, but for firmware rather than operating systems. They overlap in the vulnerability-scanning mechanism and missing-update objective, but differ in target component (OS vs firmware) and required frequency.
This control supports ISM-0298.
E8-PO-ML1.3 requires daily scanning of internet-facing servers and network devices to identify missing OS patches or updates. ISM-0298 requires a centralised, managed patching approach to ensure integrity and confirm success. The scanner output from E8-PO-ML1.3 feeds and validates the patching lifecycle in ISM-0298, focusing on applied and verified patches.
This control supports ISM-1694.
ISM-1694 requires non-critical operating system patches on internet-facing servers and network devices to be applied within two weeks under specified exploit conditions. E8-PO-ML1.3 supports this by requiring daily vulnerability scanning to identify missing patches for those same internet-facing operating systems, improving the organisation's ability to detect and action required patching. Scanning is not the same as patch deployment, but it directly strengthens the assurance that ISM-1694 patching deadlines are met.
This control supports ISM-1877.
ISM-1877 requires organisations to apply critical patches to internet-facing operating systems within 48 hours when vendor-critical or exploited. E8-PO-ML1.3 requires daily vulnerability scanning to identify missing OS patches on internet-facing servers and internet-facing network devices, which directly enables timely detection and tracking needed to meet the 48-hour patch SLA. Without the visibility and confirmation provided by E8-PO-ML1.3, consistently achieving and evidencing ISM-1877 is significantly harder.
This control depends on ISM-1808.
E8-PO-ML1.3 requires running a vulnerability scanner at least daily for internet-facing systems to identify missing OS patches/updates. ISM-1808 requires that the vulnerability scanner used has an up-to-date vulnerability database, a prerequisite for the daily scans in E8-PO-ML1.3 to be reliable and effective. E8-PO-ML1.3 specifies the cadence, while ISM-1808 specifies tool currency.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-06.1Continuously scan and assess assets for known software and configuration weaknessesPartially overlaps
This control partially overlaps IT.PRO-06.1.
IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to identify known weaknesses; E8-PO-ML1.3 is one case: scanning at least daily for missing patches or updates in operating systems of internet-facing servers and network devices.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.