Essential Eight PO-ML3.1 Vulnerability scanner used fortnightly to identify missing driver patches
What it says
A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse a vulnerability scanner every two weeks to find missing driver updates.
Using a vulnerability scanner every two weeks helps identify missing updates for drivers on your computers. This is crucial because outdated drivers could leave your systems exposed to hackers who exploit these gaps to gain access to your data or disrupt your business operations.
Free. Save your status, tasks and notes.
Why it matters
Unpatched drivers can be exploited for elevated access, causing data breaches or operational disruption.
How to implement
The IT team should schedule regular scans every two weeks using a vulnerability scanner to identify missing driver updates.
This can be set up as an automated task in the scanner's settings.
System administrators should ensure the vulnerability scanner's database is always up-to-date before running scans.
This involves checking the scanner's settings to automatically download the latest vulnerability information.
The security officer should review the results of each vulnerability scan to identify and prioritise any missing critical driver updates that need immediate attention.
They can do this by generating a report and sorting identified issues by severity.
IT support staff should apply identified missing patches to drivers as discovered by the scanner.
This can be done by following the scanner's recommendations or vendor instructions provided in the scan report.
Keep it running
Run driver-focused vulnerability scans at least fortnightly; triage findings and deploy required driver patches within the cycle.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How frequently is the vulnerability scanner used to check for missing driver updates?
Look at
Review the schedule settings in the vulnerability scanner to confirm scans occur at least fortnightly.
Good evidence
The scanner is scheduled to run every two weeks, and we have logs showing consistent scan execution within this timeframe.
- Check 2 of 2What an auditor asks for
Ask for
When was the vulnerability database last updated before a scan?
Look at
Check the scan logs for the date of the last vulnerability database update.
Good evidence
The database is updated automatically every 24 hours, and logs show it was updated just before the last scan.
Mappings
Closest match in ASD Information Security Manual: ISM-1703, Regular vulnerability scanning for missing patches, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
E8-PO-ML3.1 focuses on using a vulnerability scanner at least fortnightly to identify missing driver patches or updates. ISO/IEC 27001:2022 Annex A 8.8 requires organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures across information systems generally. E8-PO-ML3.1 is one concrete, driver-specific detection activity that fits within the broader vulnerability identification and treatment expectations of Annex A 8.8.
ASD Information Security Manual: 6 mappings
This control is equivalent to ISM-1703.
E8-PO-ML3.1 requires a vulnerability scanner to be used at least fortnightly to identify missing driver patches or updates. ISM-1703 states the same requirement with the same frequency and the same driver-focused scope. Implementing either control would largely satisfy the other with no material difference in intent or coverage.
This control partially meets ISM-1143.
E8-PO-ML3.1 requires fortnightly vulnerability scanning to identify missing driver patches or updates. ISM-1143 requires patch management processes and procedures to be developed, implemented and maintained. E8-PO-ML3.1 supports ISM-1143 by providing an operational mechanism for detecting driver patch gaps that patch procedures should address. However, it does not itself define the broader procedural governance ISM-1143 expects.
This control partially meets ISM-1163.
E8-PO-ML3.1 requires a vulnerability scanner be used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers. ISM-1163 includes this same fortnightly vulnerability scanning expectation, but broadens it into a continuous monitoring plan that also requires vulnerability assessments/penetration tests, impact analysis, and risk-based mitigation. E8-PO-ML3.1 is therefore a specific subset of the wider vulnerability management and testing lifecycle in ISM-1163.
This control supports ISM-0298.
E8-PO-ML3.1 requires fortnightly vulnerability scanning to identify missing driver patches or updates. ISM-0298 requires a centralised, managed patching approach for applications, operating systems, drivers and firmware, including integrity and confirmation of successful application. The scan results from E8-PO-ML3.1 directly feed and strengthen ISM-0298 by identifying driver patch gaps to be remediated, but E8-PO-ML3.1 does not itself mandate patch deployment controls.
This control supports ISM-1697.
ISM-1697 requires organisations to apply non-critical driver patches within one month where no working exploits exist. E8-PO-ML3.1 supports ISM-1697 by requiring fortnightly vulnerability scanning to identify missing driver patches, which helps detect non-compliance with the one-month patch window. Scanning improves visibility and assurance, but it does not itself mandate the patch application timeframe or decision conditions.
This control depends on ISM-1808.
E8-PO-ML3.1 requires fortnightly vulnerability scanning to identify missing driver patches or updates. ISM-1808 requires that the vulnerability scanner used has an up-to-date vulnerability database. To reliably meet E8-PO-ML3.1's intent (accurately identifying missing driver patches), the tooling condition in ISM-1808 is a practical prerequisite for meaningful scanning outcomes.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-06.1Continuously scan and assess assets for known software and configuration weaknessesPartially overlaps
This control partially overlaps IT.PRO-06.1.
IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to identify known software and configuration weaknesses; E8-PO-ML3.1 requires scanning at least fortnightly for missing patches or updates in drivers, one specific case of that.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.