Essential Eight PO-ML3.2 At least fortnightly use of a vulnerability scanner for firmware
What it says
A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in firmware.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse a vulnerability scanner every two weeks to find and update missing firmware patches.
This control means that every two weeks, your organisation uses a special tool to check if your devices need important updates for their firmware. Firmware is like the inner software for your hardware, and if it's not updated, your devices could be left open to attacks. Without these checks, hackers could exploit weaknesses in your devices, putting your entire system at risk.
Free. Save your status, tasks and notes.
Why it matters
Neglecting fortnightly firmware scans can leave critical hardware vulnerabilities exposed to persistent threats, endangering system integrity.
How to implement
The IT team should schedule regular scans every two weeks to identify missing firmware updates using the vulnerability scanner your organisation employs.
System administrators should ensure that the vulnerability scanner's database is up to date before running any scans to guarantee accurate and relevant results.
Security officers should oversee the installation of any missing firmware updates promptly by coordinating with the IT team once the scans are complete.
The IT manager should document each scanning session and the actions taken afterward to keep a clear record of ongoing security management efforts.
Keep it running
Run a firmware vulnerability scanner at least fortnightly across all device types; keep signatures current and promptly patch or update any flagged firmware.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How often are vulnerability scans for firmware updates conducted?
Look at
Examine the schedule documented for vulnerability scans and logs from past scans.
Good evidence
The organisation conducts vulnerability scans for firmware at least every two weeks, and logs confirm this regularity.
- Check 2 of 2What an auditor asks for
Ask for
Is the vulnerability scanner database regularly updated?
Look at
Review logs or records showing the last update time of the vulnerability scan database.
Good evidence
The database is updated prior to each scanning session, as evidenced by documented update times.
Mappings
Closest match in ASD Information Security Manual: ISM-1900, Fortnightly system vulnerability scanning, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
E8-PO-ML3.2 requires organisations to conduct at least fortnightly vulnerability scanning specifically to identify missing firmware patches or updates. ISO/IEC 27001:2022 Annex A 8.8 is broader, requiring organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures across information systems generally. E8-PO-ML3.2 is a specific, prescriptive method (fortnightly scanning for firmware) that can be used to meet part of Annex A 8.8's broader vulnerability management expectations.
ASD Information Security Manual: 8 mappings
This control is equivalent to ISM-1900.
E8-PO-ML3.2 requires a vulnerability scanner to be used at least fortnightly to identify missing patches or updates for vulnerabilities in firmware. ISM-1900 states the same requirement with the same frequency and the same firmware-specific scope. Implementing ISM-1900 would largely satisfy E8-PO-ML3.2 and vice versa.
This control partially overlaps ISM-1703.
ISM-1703 requires using a vulnerability scanner at least fortnightly to identify missing patches or updates for vulnerabilities in drivers. E8-PO-ML3.2 uses the same scanning approach and cadence, but applies it to firmware rather than drivers. ISM-1703 and E8-PO-ML3.2 therefore overlap on the vulnerability scanning mechanism and frequency, but differ in the technology layer being assessed.
This control partially overlaps ISM-1752.
ISM-1752 requires organisations to use a vulnerability scanner at least fortnightly to identify missing operating system patches on IT equipment other than workstations, servers, and network devices. E8-PO-ML3.2 also requires fortnightly scanning, but focuses specifically on identifying missing firmware patches/updates rather than operating system patches. They overlap on the scanning cadence and vulnerability scanning practice, but differ in technical scope (OS vs firmware) and in the asset classes explicitly in scope.
This control partially overlaps ISM-1903.
E8-PO-ML3.2 requires organisations to use a vulnerability scanner at least fortnightly to identify missing patches or updates for vulnerabilities in firmware. ISM-1903 overlaps by addressing firmware vulnerabilities, but it mandates a remediation timeframe (apply critical firmware patches within 48 hours) rather than specifying scanning cadence. The primary is about detection frequency, while ISM-1903 is about response speed once firmware vulnerabilities/updates are known.
This control partially overlaps ISM-1904.
E8-PO-ML3.2 requires organisations to scan firmware at least fortnightly to identify missing patches or updates. ISM-1904 overlaps in the same firmware vulnerability domain but focuses on applying non-critical firmware patches within one month under specific conditions, not on scanning frequency. E8-PO-ML3.2 provides the detection mechanism that helps trigger the patching activity required by ISM-1904, but neither control fully replaces the other.
This control supports ISM-0298.
E8-PO-ML3.2 requires organisations to run fortnightly vulnerability scanning to find missing firmware patches and updates. ISM-0298 supports this by requiring a centralised, managed approach to apply patches/updates (including firmware) and confirm successful application, which helps remediate issues E8-PO-ML3.2 identifies. E8-PO-ML3.2 focuses on detection cadence, whereas ISM-0298 focuses on controlled deployment and verification of patching.
This control depends on ISM-1807.
E8-PO-ML3.2 requires organisations to scan at least fortnightly to find missing firmware patches and updates. ISM-1807 supports this by requiring at least fortnightly automated asset discovery so firmware-bearing assets are identified and then included in subsequent vulnerability scanning. ISM-1807 does not itself require firmware vulnerability scanning, but it improves completeness and coverage of E8-PO-ML3.2.
This control depends on ISM-1808.
E8-PO-ML3.2 requires fortnightly vulnerability scanning to identify missing firmware patches or updates. ISM-1808 requires that the vulnerability scanner used has an up-to-date vulnerability database, which is necessary for E8-PO-ML3.2 scanning results to be accurate and actionable for firmware. E8-PO-ML3.2 sets the activity and frequency, while ISM-1808 sets a prerequisite quality condition for the scanning tool.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-06.1Continuously scan and assess assets for known software and configuration weaknessesPartially overlaps
This control partially overlaps IT.PRO-06.1.
IT.PRO-06.1 requires continuous, repeatable assessment, including vulnerability scanning, to identify known software and configuration weaknesses; E8-PO-ML3.2 requires scanning at least fortnightly for missing patches or updates in firmware, one specific case of that.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.