Essential Eight PO-ML3.4 Non-critical OS patches applied within one month if no exploits exist
What it says
Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishApply OS patches on internal devices within a month if they aren't critical and have no known exploits.
This control is about making sure your computers and devices are kept up-to-date with the latest patches, but only for non-critical issues. If there are no known ways hackers can exploit these issues, you have up to a month to apply these updates. Not updating could mean leaving your systems more vulnerable to new threats.
Free. Save your status, tasks and notes.
Why it matters
Delaying non-critical OS patches beyond one month can let attackers chain low-severity flaws into compromise, disrupting workstations and internal services.
How to implement
IT team should keep a regular schedule for checking updates by setting up reminders or using automated tools to ensure no update is missed within the monthly window.
System administrators need to review which updates are released from software vendors.
They should use vendor notifications or patch management tools to track this.
Security officer should ensure that the risk assessments for patches are accurate by collaborating with vendors to understand the criticality of each update.
IT personnel should document the patching process by maintaining a log of patches applied, including date and time, to ensure transparency and accountability.
Keep it running
Monitor vendor OS advisories weekly; confirm severity is non-critical and that no working exploits exist, then schedule deployment to all scoped assets within 30 days.
Evidence and audit
- Check 1 of 1What an auditor asks for
Ask for
How does the organisation determine which updates are applied within the month for non-critical vulnerabilities?
Look at
Check the logs or records of updates applied to systems, noting the dates they were applied.
Good evidence
The logs should show all non-critical updates applied within one month of their release, along with evidence of why they were classified as non-critical.
Mappings
Closest match in ASD Information Security Manual: ISM-1902, Apply non-critical patches to non-internet systems promptly, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
E8-PO-ML3.4 requires a specific operational treatment of technical vulnerabilities: applying non-critical OS patches within one month for defined internal asset classes when no working exploits exist. ISO/IEC 27001:2022 Annex A 8.8 requires organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures, but it does not prescribe specific patching timeframes or the exact asset scope. E8-PO-ML3.4 is therefore a concrete, time-bound implementation subset of the broader vulnerability management expectations in Annex A 8.8.
ASD Information Security Manual: 10 mappings
This control is equivalent to ISM-1902.
E8-PO-ML3.4 requires patches, updates or vendor mitigations for non-critical OS vulnerabilities (with no working exploits) to be applied within one month on workstations, non-internet-facing servers and non-internet-facing network devices. ISM-1902 states the same scope (OS on those internal device types), the same conditions (non-critical vendor assessment and no working exploits), and the same timeframe (within one month). Implementing ISM-1902 would therefore largely satisfy E8-PO-ML3.4 for this patching scenario.
This control partially meets ISM-1695.
E8-PO-ML3.4 requires applying operating system patches on workstations, non-internet-facing servers and non-internet-facing network devices within one month when the vulnerability is non-critical and has no working exploits. ISM-1695 also mandates applying OS patches within one month, directly aligning on asset classes and timeframe. However, ISM-1695 does not include the Essential Eight's explicit condition that the vendor rates the vulnerability non-critical and that no working exploits exist, making E8-PO-ML3.4 more specific in its trigger criteria.
This control partially overlaps ISM-1694.
E8-PO-ML3.4 requires applying non-critical OS patches within one month for non-internet-facing workstations, servers and network devices when no working exploits exist. ISM-1694 addresses the same non-critical/no-exploit condition but for internet-facing servers and internet-facing network devices, and mandates a two-week timeframe. The controls overlap on the concept of severity- and exploit-aware OS patching, but differ materially in exposure scope (internal vs internet-facing) and required timeliness.
This control partially overlaps ISM-1696.
E8-PO-ML3.4 sets a one-month patching requirement for non-critical OS vulnerabilities on non-internet-facing workstations/servers/network devices when no working exploits exist. ISM-1696 covers the same OS and internal asset scope, but applies to the different condition of critical vendor ratings or the existence of working exploits, with a much shorter 48-hour timeframe. They intersect on the same patch management activity and assets, but address different severity/exploit scenarios and therefore are complementary rather than equivalent.
This control partially overlaps ISM-1697.
ISM-1697 requires applying non-critical patches for driver vulnerabilities within one month when no working exploits exist. E8-PO-ML3.4 sets the same one-month/non-critical/no-exploit requirement, but for operating systems on workstations and non-internet-facing servers/devices rather than drivers. They overlap on patch timeliness for non-critical vulnerabilities, but differ in the asset category being patched.
This control partially overlaps ISM-1751.
E8-PO-ML3.4 requires non-critical OS patching within one month for workstations, non-internet-facing servers and non-internet-facing network devices when no working exploits exist. ISM-1751 applies the same non-critical/no-exploit and one-month requirement, but for OS on IT equipment other than workstations, servers and network devices. They align on the patching rule and timing, but apply to different asset categories, so each leaves gaps the other does not cover.
This control partially overlaps ISM-1904.
E8-PO-ML3.4 requires applying non-critical operating system patches within one month on internal workstations, non-internet-facing servers, and non-internet-facing network devices where no working exploits exist. ISM-1904 mirrors the same timing and exploit/non-critical conditions but applies them to firmware rather than operating systems. They align on risk-based patch prioritisation and timeframe, but differ on the technology layer (OS vs firmware) and therefore are only partially overlapping.
This control supports ISM-0298.
E8-PO-ML3.4 requires that organisations achieve timely OS patching (within one month) for specific internal device classes when vulnerabilities are non-critical and not exploited. ISM-0298 establishes the centralised patch and update management capability to distribute patches reliably and confirm successful application across operating systems and other components. ISM-0298 supports E8-PO-ML3.4 by providing the mechanism and assurance to consistently meet the one-month patching requirement, but it does not itself set the same conditional timeframe for non-critical OS vulnerabilities.
This control depends on ISM-1143.
E8-PO-ML3.4 requires a defined operational outcome: non-critical, non-exploited OS vulnerabilities on internal devices are patched within one month. ISM-1143 requires organisations to develop, implement and maintain patch management processes and procedures that govern how patching decisions and actions occur. In practice, consistently meeting E8-PO-ML3.4 at scale depends on ISM-1143-style procedures (intake, assessment, scheduling, approvals and verification), even though ISM-1143 does not mandate the specific one-month SLA.
This control depends on ISM-1702.
ISM-1702 requires fortnightly scanning to identify missing operating system patches on workstations, non-internet-facing servers, and non-internet-facing network devices. E8-PO-ML3.4 requires non-critical OS patches for those same non-internet-facing assets to be applied within one month when no working exploits exist. ISM-1702 supports E8-PO-ML3.4 by enabling identification of missing patches, but it does not define prioritisation rules or patch application deadlines.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-06.2Apply security patches within risk-based timeframes and automate low-impact updatesPartially overlaps
This control partially overlaps IT.PRO-06.2.
IT.PRO-06.2 requires security patches to be applied within risk-based timeframes; E8-PO-ML3.4 sets one month to patch operating systems of workstations and non-internet-facing servers and network devices when vendors rate vulnerabilities non-critical and no working exploits exist, one specific case.
- IT.PRO-06.3Remediate or mitigate above-threshold vulnerabilities within defined timeframes and verify effectivenessPartially overlaps
This control partially overlaps IT.PRO-06.3.
IT.PRO-06.3 requires vulnerabilities above risk thresholds to be remediated or mitigated in set timeframes; E8-PO-ML3.4 sets one month to patch operating systems of workstations and non-internet-facing servers and network devices when vendors rate vulnerabilities non-critical and no working exploits exist, one such timeframe.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.