Essential Eight PO-ML1.5 Apply critical patches to internet-facing OS within 48 hours
What it says
Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishApply critical updates to internet-facing systems within 48 hours to prevent exploitation.
This control ensures that critical security updates are applied to your internet-connected systems within 48 hours. It's like fixing a broken lock on your front door quickly to prevent burglars from walking right in. Without these updates, your business could be open to cyber criminals exploiting known weaknesses.
Free. Save your status, tasks and notes.
Why it matters
Delaying critical patches on internet-facing OS/devices beyond 48 hours increases exposure to known exploits, enabling compromise, data theft and service disruption.
How to implement
System administrators should track when critical updates are released by vendors to stay informed about necessary patches.
IT teams need to configure their systems to check for updates daily and to apply them automatically whenever possible to meet the 48-hour timeframe.
Security officers should monitor industry alert services, such as the Australian Cyber Security Centre, to identify if a vulnerability exploits are in the wild and need immediate action.
The IT director should ensure there is a clear process in place for responding to critical patches, including assigning responsibility and setting deadlines for application.
Keep it running
Track vendor advisories and exploit intel; prioritise internet-facing OS/network devices and use an emergency change process to deploy critical patches within 48 hours.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How do you ensure you're aware of new critical patches released by vendors?
Look at
Examine records of subscriptions or notifications from vendors or cyber security alert services.
Good evidence
The organisation receives daily notices from software vendors detailing new critical vulnerabilities and patches.
- Check 2 of 2What an auditor asks for
Ask for
What is your process for applying critical patches within 48 hours?
Look at
Review system logs to verify that patches were applied within the specified timeframe.
Good evidence
The logs show that critical updates were applied within 48 hours consistently over the past six months.
Mappings
Closest match in ASD Information Security Manual: ISM-1877, Timely application of critical security patches, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
E8-PO-ML1.5 requires organisations to apply critical patches within 48 hours for operating systems on internet-facing servers and internet-facing network devices when critical or exploited. ISO/IEC 27001:2022 Annex A 8.8 requires obtaining information about technical vulnerabilities, evaluating exposure, and taking appropriate measures, which encompasses patching as one possible treatment. E8-PO-ML1.5 is a prescriptive, time-bound subset of the broader vulnerability management expectation in Annex A 8.8.
ASD Information Security Manual: 16 mappings
This control is equivalent to ISM-1877.
ISM-1877 requires critical vendor patches/updates/mitigations for operating systems of internet-facing servers and internet-facing network devices to be applied within 48 hours when rated critical or when working exploits exist. E8-PO-ML1.5 states the same 48-hour requirement for the same asset classes and triggering conditions. In practice, implementing E8-PO-ML1.5 would substantially satisfy ISM-1877 for the stated scope.
This control partially overlaps ISM-1407.
ISM-1407 requires organisations to stay on the latest or previous OS release to reduce exposure to known vulnerabilities and maintain vendor currency. E8-PO-ML1.5 requires applying critical OS patches to internet-facing systems within 48 hours, which is a patch-timeliness requirement rather than a version-currency requirement. They intersect because current OS releases are more likely to receive timely patches, but each control has distinct obligations (version selection vs patch SLAs).
This control partially overlaps ISM-1606.
ISM-1606 requires patches, updates or vendor mitigations to be applied in a timely manner to software-based isolation mechanisms (e.g. hypervisors) and their underlying host operating systems when sharing physical server hardware. E8-PO-ML1.5 overlaps by mandating rapid remediation (within 48 hours) for critical/exploited operating system vulnerabilities on internet-facing servers and network devices, which can include exposed hypervisor hosts. The overlap is limited to the host operating system patching outcome; ISM-1606 also explicitly includes the isolation mechanism itself and is not limited to internet-facing assets or to 'critical' classifications.
This control partially overlaps ISM-1694.
ISM-1694 requires applying vendor mitigations for non-critical vulnerabilities in operating systems on internet-facing servers and network devices within two weeks when no working exploits exist. E8-PO-ML1.5 covers the same platforms (internet-facing OS on servers and network devices), but for a different trigger and timeframe: critical vulnerabilities or working exploits within 48 hours. They overlap on patching internet-facing operating systems, but address different severity/exploit conditions and response timelines.
This control partially overlaps ISM-1696.
ISM-1696 requires applying critical OS patches within 48 hours for workstations, non-internet-facing servers and non-internet-facing network devices when vendors rate vulnerabilities critical or working exploits exist. E8-PO-ML1.5 also mandates a 48-hour patch window under the same critical/exploit conditions, but it applies to internet-facing servers and internet-facing network devices. They align on urgency and decision triggers, but differ materially on asset exposure scope (internet-facing versus non-internet-facing/workstations).
This control partially overlaps ISM-1876.
E8-PO-ML1.5 requires critical vendor patches or mitigations to be applied within 48 hours for operating systems on internet-facing servers and internet-facing network devices when rated critical or when exploits exist. ISM-1876 imposes the same 48-hour critical/exploited patching requirement but for vulnerabilities in online services rather than specifically OS on internet-facing servers/devices. They align on urgency and triggering conditions, but differ on technical scope (online services vs operating systems on internet-facing infrastructure).
This control partially overlaps ISM-1878.
ISM-1878 requires critical OS patches for IT equipment (other than workstations, servers and network devices) to be applied within 48 hours when rated critical or when working exploits exist. E8-PO-ML1.5 aligns on the same 48-hour trigger, but applies specifically to internet-facing servers and internet-facing network devices. The time/trigger logic overlaps, however the asset scope is largely different (internet-facing servers/network devices vs other types of IT equipment).
This control partially overlaps ISM-1879.
E8-PO-ML1.5 requires critical vendor patches or mitigations to be applied within 48 hours for operating systems on internet-facing servers and internet-facing network devices when rated critical or when exploits exist. ISM-1879 applies the same 48-hour critical/exploited patching expectation but targets vulnerabilities in drivers, not specifically internet-facing OS on servers/devices. The controls overlap on the 48-hour remediation requirement and trigger conditions, but cover different asset classes and exposure assumptions.
This control partially overlaps ISM-1902.
ISM-1902 requires organisations to apply non-critical operating system patches to non-internet-facing systems within one month when no working exploits exist. E8-PO-ML1.5 relates by addressing OS patching for internet-facing servers and network devices but is triggered by critical vendor ratings or working exploits and requires patching within 48 hours. They overlap in managing OS vulnerabilities through prompt patching but differ in system exposure (internet-facing vs non-internet-facing) and severity/time requirements.
This control supports ISM-1163.
E8-PO-ML1.5 requires critical patches or vendor mitigations to be applied within 48 hours for internet-facing operating systems on servers and network devices when critical or exploited. ISM-1163 requires continuous monitoring activities (including frequent vulnerability scans, analysis, and implementing mitigations based on risk) that help identify and prioritise patching needs quickly. ISM-1163 does not set the same explicit 48-hour patch SLA for internet-facing OS, but it strengthens an organisation's ability to meet E8-PO-ML1.5 by improving detection and decision-making.
This control depends on ISM-0298.
E8-PO-ML1.5 requires organisations to apply critical patches to internet-facing operating systems on servers and network devices within 48 hours of release when critical or exploited. ISM-0298 requires a centralised, managed patching approach that preserves patch integrity and confirms successful deployment across applications, operating systems, drivers and firmware. Implementing ISM-0298 provides the operational mechanism (distribution and verification) that is typically prerequisite to consistently meeting E8-PO-ML1.5's 48-hour timeframe at scale.
This control depends on ISM-1143.
E8-PO-ML1.5 requires critical vendor patches or mitigations to be applied within 48 hours to internet-facing operating systems on servers and network devices when critical or exploited. ISM-1143 requires patch management processes and supporting procedures to be developed, implemented and maintained. Those defined processes (e.g., prioritisation, emergency change, testing exceptions, and verification) are generally necessary to reliably achieve the specific 48-hour requirement in E8-PO-ML1.5.
This control depends on ISM-1643.
ISM-1643 requires maintaining detailed records of operating system versions and patch histories in software registers. This supports E8-PO-ML1.5 by allowing validation that critical patches for internet-facing operating systems and network devices were applied within 48 hours. E8-PO-ML1.5 drives urgent patching actions, while ISM-1643 provides the recordkeeping needed to demonstrate compliance and identify gaps.
This control depends on ISM-1701.
ISM-1701 requires daily vulnerability scanning of internet-facing servers and network devices to identify missing OS patches or updates. E8-PO-ML1.5 requires applying critical OS patches for those same internet-facing assets within 48 hours, which is an action taken after vulnerabilities/patch gaps are identified. ISM-1701 supports E8-PO-ML1.5 by providing the detection mechanism that informs and prioritises urgent patching, but it does not itself mandate remediation timeframes.
This control depends on ISM-1753.
ISM-1753 requires replacement of internet-facing network devices that are no longer supported by vendors. E8-PO-ML1.5 drives rapid patching of vulnerabilities in operating systems of internet-facing servers and internet-facing network devices, reducing exposure while devices remain supported. ISM-1753 addresses end-of-support risk that patching cannot remediate once vendor updates cease, so E8-PO-ML1.5 strengthens but does not replace the need for device replacement.
This control depends on ISM-1921.
ISM-1921 requires organisations to frequently reassess the likelihood of compromise when working exploits exist for unmitigated vulnerabilities. E8-PO-ML1.5 supports ISM-1921 by prioritising remediation for exploited/critical vulnerabilities on internet-facing operating systems and network devices, which are high-likelihood compromise scenarios that warrant frequent reassessment and escalation decisions. E8-PO-ML1.5 is a remediation SLA for a specific asset exposure category, whereas ISM-1921 is the ongoing reassessment requirement regardless of whether patching is immediately achievable.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-06.2Apply security patches within risk-based timeframes and automate low-impact updatesPartially overlaps
This control partially overlaps IT.PRO-06.2.
IT.PRO-06.2 requires security patches to be applied within risk-based timeframes; E8-PO-ML1.5 sets 48 hours to patch operating systems of internet-facing servers and network devices when vendors rate vulnerabilities critical or working exploits exist, one specific case of that.
- IT.PRO-06.3Remediate or mitigate above-threshold vulnerabilities within defined timeframes and verify effectivenessPartially overlaps
This control partially overlaps IT.PRO-06.3.
IT.PRO-06.3 requires vulnerabilities above risk thresholds to be remediated or mitigated in set timeframes; E8-PO-ML1.5 sets 48 hours to patch operating systems of internet-facing servers and network devices when vendors rate vulnerabilities critical or working exploits exist, one such timeframe.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.