Essential Eight PO-ML1.4 Use a vulnerability scanner fortnightly to find missing OS patches
What it says
A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse a vulnerability scanner every two weeks to check for missing OS updates on internal systems.
Using a vulnerability scanner every two weeks helps make sure your computers and servers are safe from known security weaknesses. Without regular checks, hackers might exploit these weaknesses to access your systems and data, leading to potential data loss or business disruption.
Free. Save your status, tasks and notes.
Why it matters
Missing your fortnightly scan may leave critical OS vulnerabilities unnoticed, allowing attackers to exploit them and potentially disrupt business operations.
How to implement
The IT team should schedule regular vulnerability scans every two weeks to find any missing security updates on computers and servers.
Use reliable scanning software and set specific dates to ensure consistency.
System administrators should ensure the vulnerability scanner's database is updated before each scan to identify the latest threats.
They can do this by connecting the scanner to the internet to download updates prior to running a scan.
Security officers should monitor the results of the scans and prioritise applying patches that fix the most important vulnerabilities.
They can use a risk assessment guide to decide which patches need to be applied first.
The IT team should keep records of each scan's results and actions taken.
This involves documenting when the scan was done, what was found, and what was fixed.
Managers should review scan reports regularly to understand the overall security position of the organisation and ensure the IT team follows through on addressing any vulnerabilities found.
Keep it running
Run the vulnerability scanner at least fortnightly and review findings the same day to identify missing OS patches on workstations and non-internet-facing servers/devices.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How often are vulnerability scans performed on your systems?
Look at
Examine the vulnerability scanner's schedule and logs to verify scans occur every two weeks.
Good evidence
Logs and schedules show vulnerability scans are consistently performed every fortnight, with documented results.
- Check 2 of 2What an auditor asks for
Ask for
How do you ensure the vulnerability database is current before a scan?
Look at
Check updates for the scanner's database just before scans.
Good evidence
There are records showing the database is updated within 24 hours before each scan.
Mappings
Closest match in ASD Information Security Manual: ISM-1702, Regularly scan for missing security patches, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
E8-PO-ML1.4 requires fortnightly vulnerability scanning to identify missing OS patches on internal systems. ISO/IEC 27001:2022 Annex A 8.8 requires the organisation to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures, which can be implemented using vulnerability scanning and patch identification. Annex A 8.8 is broader and risk-oriented and does not prescribe a fortnightly cadence or limit scope to operating system patch status.
ASD Information Security Manual: 6 mappings
This control is equivalent to ISM-1702.
ISM-1702 requires a vulnerability scanner to be used at least fortnightly to identify missing patches/updates for operating systems on workstations, non-internet-facing servers, and non-internet-facing network devices. E8-PO-ML1.4 states the same scanning cadence and the same scope of assets and OS patch identification. Implementing E8-PO-ML1.4 would largely satisfy ISM-1702 with no material differences in intent or coverage.
This control partially meets ISM-1163.
E8-PO-ML1.4 requires a vulnerability scanner to be used at least fortnightly to identify missing operating system patches on internal (non-internet-facing) workstations, servers and network devices. ISM-1163 includes this same fortnightly vulnerability scanning expectation as part of a broader continuous monitoring plan that also mandates pre-deployment scanning, ongoing assessments/penetration testing, vulnerability impact analysis, and risk-based mitigations. In effect, E8-PO-ML1.4 is one specific scanning activity that contributes to meeting only part of ISM-1163.
This control partially overlaps ISM-1703.
ISM-1703 requires a fortnightly vulnerability scan to identify missing patches or updates for driver vulnerabilities. E8-PO-ML1.4 also mandates at least fortnightly vulnerability scanning for missing patches, but targets operating systems on workstations, non-internet-facing servers, and non-internet-facing network devices. ISM-1703 and E8-PO-ML1.4 overlap on the scanning practice and cadence, but cover different components (drivers vs OS/network device OS).
This control supports ISM-0298.
E8-PO-ML1.4 requires fortnightly vulnerability scanning to identify missing OS patches on internal systems. ISM-0298 requires a centralised, managed patch/update approach that maintains integrity and confirms successful application across applications, operating systems, drivers and firmware. Scanner results from E8-PO-ML1.4 can feed and validate ISM-0298's patch process, but E8-PO-ML1.4 does not itself establish patch governance or confirmation of deployment success.
This control supports ISM-1696.
ISM-1696 requires organisations to apply critical operating system patches within 48 hours for workstations and non-internet-facing servers and network devices when vendors rate issues critical or working exploits exist. E8-PO-ML1.4 requires fortnightly vulnerability scanning to identify missing OS patches on the same asset classes, which provides an operational mechanism to detect patch gaps and validate patch compliance. While scanning does not itself meet the 48-hour patching requirement, ISM-1696 is practically dependent on discovery/verification activities like E8-PO-ML1.4 to reliably identify missing critical patches across the environment.
This control depends on ISM-1808.
E8-PO-ML1.4 requires fortnightly vulnerability scanning to identify missing OS patches on internal systems. ISM-1808 requires that the vulnerability scanner used has an up-to-date vulnerability database, which is a prerequisite for the scans in E8-PO-ML1.4 to accurately detect missing patches and relevant vulnerabilities. E8-PO-ML1.4 specifies cadence and target asset types, while ISM-1808 specifies tool currency/quality needed to make those scans reliable.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-06.1Continuously scan and assess assets for known software and configuration weaknessesPartially overlaps
This control partially overlaps IT.PRO-06.1.
IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to find known weaknesses; E8-PO-ML1.4 is one case: scanning at least fortnightly for missing patches in operating systems of workstations and non-internet-facing servers and network devices.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.