Essential Eight PO-ML1.6 Timely application of non-critical patches for internet-facing OS vulnerabilities
What it says
Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishApply non-critical patches to internet-facing systems within two weeks if no exploits exist.
This control means that if there are any weaknesses found in the operating systems of your internet-facing computers and devices, these need to be fixed within two weeks, unless those weaknesses are already being exploited by hackers. This matters because if such vulnerabilities are ignored, they could be used by cybercriminals to break into your network, potentially causing data breaches or interruptions to your business operations.
Free. Save your status, tasks and notes.
Why it matters
Ignoring non-critical patches for internet-facing OS or network devices can expose services to rapid weaponisation, enabling compromise and service disruption.
How to implement
The IT team should review patch release notes from vendors to identify if any non-critical vulnerabilities exist.
They can do this by subscribing to notifications from operating system providers.
The system administrator should schedule regular patching scans for internet-facing systems every fortnight.
They can use an automated patch management tool to assist with this.
The security officer should establish a protocol for assessing whether exploits for identified vulnerabilities exist.
This could involve checking resources like the Cyber security and Infrastructure Security Agency's Known Exploited Vulnerabilities Catalogue.
Management should ensure the IT department has a clear policy outlining the timeline and steps for applying non-critical patches to internet-facing systems.
Regular training sessions for IT staff can reinforce these policies.
Keep it running
Track vendor advisories for internet-facing OS and network devices; where rated non-critical with no working exploit, deploy patches within 14 days and record exceptions.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
How often do you check for new patches released by vendors?
Look at
Review the patch management schedule and notifications from vendors.
Good evidence
The organisation checks for updates at least weekly and has an automated process for discovering patches.
- Check 2 of 3What an auditor asks for
Ask for
How do you determine if a vulnerability is non-critical and if exploits exist?
Look at
Review logs and reports from vulnerability assessments.
Good evidence
The organisation uses a recognised vulnerability catalogue and risk assessment process to verify threats.
- Check 3 of 3What an auditor asks for
Ask for
When was the last time patches were applied to vulnerabilities assessed as non-critical?
Look at
Check patch application records with dates.
Good evidence
Patches for non-critical vulnerabilities were applied within two weeks of their release.
Mappings
Closest match in ASD Information Security Manual: ISM-1694, Timely application of non-critical security patches, which asks for the same thing.
ASD Information Security Manual: 6 mappings
This control is equivalent to ISM-1694.
E8-PO-ML1.6 requires applying non-critical patches (where no working exploits exist) to operating systems on internet-facing servers and internet-facing network devices within two weeks of vendor release. ISM-1694 states the same patching requirement with the same scope (internet-facing OS on servers and network devices), the same condition (non-critical, no working exploits), and the same timeframe (two weeks). Implementing either control would largely satisfy the other.
This control partially overlaps ISM-1606.
ISM-1606 requires timely remediation of vulnerabilities by applying patches/updates/mitigations to the isolation mechanism and the underlying host operating system on shared physical servers. E8-PO-ML1.6 overlaps where the underlying host operating system is on an internet-facing server/device, requiring non-critical OS vulnerabilities to be addressed within two weeks. ISM-1606 remains distinct because it targets the isolation layer as well as the host OS and is framed around maintaining safe multi-tenancy rather than exposure-based patch SLAs.
This control partially overlaps ISM-1690.
ISM-1690 requires non-critical vulnerability patches for online services to be applied within two weeks where no working exploits exist. E8-PO-ML1.6 applies a very similar two-week non-critical patching requirement, but specifically for operating systems of internet-facing servers and internet-facing network devices rather than online services broadly. They overlap on timely remediation for internet-exposed components, however ISM-1690 is service-focused while E8-PO-ML1.6 is OS/network-device-focused.
This control partially overlaps ISM-1877.
E8-PO-ML1.6 requires applying non-critical OS patches to internet-facing servers and network devices within two weeks when no working exploits exist. ISM-1877 covers the same asset scope (internet-facing OS on servers and network devices) but applies to critical vulnerabilities or where working exploits exist, with a much shorter timeframe (48 hours). The controls align on patching internet-facing OS, but differ on severity/exploit conditions and mandated urgency.
This control partially overlaps ISM-1902.
E8-PO-ML1.6 requires non-critical OS patches for internet-facing servers and internet-facing network devices to be applied within two weeks when no working exploits exist. ISM-1902 addresses the same patching concept and conditions (non-critical, no working exploits) but applies it to workstations and non-internet-facing servers/devices with a different timeframe (one month). They overlap on patch management intent for OS vulnerabilities, but differ materially on asset exposure (internet-facing vs not) and required speed.
This control depends on ISM-1143.
E8-PO-ML1.6 requires a defined patching outcome for a specific scope: non-critical internet-facing OS vulnerabilities must be remediated within two weeks when no working exploits exist. ISM-1143 requires that patch management processes and procedures are developed, implemented and maintained. Effective compliance with E8-PO-ML1.6 is dependent on having the patch governance, workflow, and supporting procedures required by ISM-1143 to consistently meet the two-week SLA.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-06.2Apply security patches within risk-based timeframes and automate low-impact updatesPartially overlaps
This control partially overlaps IT.PRO-06.2.
IT.PRO-06.2 requires security patches to be applied within risk-based timeframes; E8-PO-ML1.6 sets two weeks to patch operating systems of internet-facing servers and network devices when vendors rate vulnerabilities non-critical and no working exploits exist, one specific case of that.
- IT.PRO-06.3Remediate or mitigate above-threshold vulnerabilities within defined timeframes and verify effectivenessPartially overlaps
This control partially overlaps IT.PRO-06.3.
IT.PRO-06.3 requires vulnerabilities above risk thresholds to be remediated or mitigated in set timeframes; E8-PO-ML1.6 sets two weeks to patch operating systems of internet-facing servers and network devices when vendors rate vulnerabilities non-critical and no working exploits exist, one such timeframe.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.