Essential Eight PO-ML3.5 Apply critical driver patches within 48 hours

This control partially meets A.8.8.

E8-PO-ML3.5 requires a specific vulnerability treatment action: apply critical driver patches (or mitigations) within 48 hours when rated critical or exploited. Annex A 8.8 requires the organisation to obtain information about technical vulnerabilities, evaluate exposure and take appropriate measures, which includes patching as one possible measure. E8-PO-ML3.5 is a prescriptive subset of Annex A 8.8, with tighter scope (drivers) and a defined timeframe.

This control depends on A.5.7.

E8-PO-ML3.5 requires organisations to apply critical driver patches within 48 hours based on vendor criticality or known working exploits. Annex A 5.7 requires collection and analysis of threat information to produce threat intelligence, which can inform whether exploits are active and where driver vulnerabilities are being weaponised. This threat intelligence supports prioritisation and justification for rapid patching in E8-PO-ML3.5, but it does not mandate patch deployment timeframes.

This control is equivalent to ISM-1879.

E8-PO-ML3.5 requires organisations to apply vendor patches or mitigations for critical driver vulnerabilities within 48 hours (or when working exploits exist). ISM-1879 states the same driver-specific 48-hour requirement under the same criticality/exploit conditions. The scope, trigger conditions and timeframe align closely, so meeting ISM-1879 would largely satisfy E8-PO-ML3.5.

This control partially meets ISM-1754.

ISM-1754 requires vulnerabilities identified in software to be resolved in a timely manner. E8-PO-ML3.5 mandates applying critical driver patches within 48 hours, which is a specific category of software vulnerability remediation that contributes to meeting ISM-1754. The candidate is narrower because it is limited to drivers and a particular timeliness threshold.

This control partially overlaps ISM-0300.

ISM-0300 requires that patches, updates or vendor mitigations for vulnerabilities in high assurance IT equipment are only applied when approved by ASD and using ASD-prescribed methods and timeframes. E8-PO-ML3.5 also concerns applying patches (for drivers) and imposes a 48-hour timeframe for critical issues or where exploits exist, which can be relevant where drivers are part of high assurance equipment. However, ISM-0300 is defined by ASD approval and ASD-directed methods for a specific equipment class, while E8-PO-ML3.5 is a general operational timeliness requirement without an external approval gate.

This control partially overlaps ISM-1697.

ISM-1697 requires organisations to apply vendor mitigations for driver vulnerabilities within one month when they are assessed as non-critical and no working exploits exist. E8-PO-ML3.5 addresses the same technology scope (drivers) but applies to critical vulnerabilities or those with working exploits and requires patching within 48 hours. The controls overlap on driver patching governance, but they target different risk conditions and impose different timeframes.

This control supports ISM-1163.

E8-PO-ML3.5 requires applying critical driver patches within 48 hours when vendors rate them critical or exploits exist. ISM-1163 establishes continuous monitoring activities (scanning, assessment, analysis and risk-based mitigation) that help identify affected systems and prioritise remediation. ISM-1163 supports timely execution and verification of E8-PO-ML3.5, but it does not itself mandate the specific 48-hour driver patch window.

This control supports ISM-1921.

ISM-1921 requires organisations to frequently reassess compromise likelihood when working exploits exist for unmitigated vulnerabilities. E8-PO-ML3.5 supports ISM-1921 by defining an urgent response expectation for exploited/critical driver vulnerabilities, which should prompt repeated compromise-likelihood reassessment (e.g., exposure, affected fleets, compensating controls) until patched. E8-PO-ML3.5 is a patching SLA, while ISM-1921 governs the reassessment process that prioritises and validates that urgency based on exploit conditions.

This control depends on ISM-0298.

E8-PO-ML3.5 requires critical driver patches to be applied within 48 hours of release when rated critical or when exploits exist. ISM-0298 requires a centralised, managed patching approach that preserves patch integrity and confirms successful application across applications, operating systems, drivers and firmware. In practice, achieving the 48-hour driver patch SLA in E8-PO-ML3.5 at scale typically depends on having the centralised patch management capability mandated by ISM-0298, though ISM-0298 does not set the 48-hour timeframe.

This control depends on ISM-1143.

E8-PO-ML3.5 requires organisations to patch critical driver vulnerabilities within 48 hours under defined trigger conditions. ISM-1143 requires patch management processes and procedures to be developed, implemented and maintained. Those procedures (triage, testing, deployment, exception handling) are a prerequisite to reliably meeting the 48-hour driver patching requirement in E8-PO-ML3.5, but ISM-1143 is broader and not driver/timeframe-specific.

This control partially overlaps IT.PRO-06.2.

IT.PRO-06.2 requires security patches to be applied within risk-based timeframes; E8-PO-ML3.5 sets 48 hours to patch drivers when vendors rate vulnerabilities critical or working exploits exist, one specific case of that.

This control partially overlaps IT.PRO-06.3.

IT.PRO-06.3 requires vulnerabilities above risk thresholds to be remediated or mitigated in set timeframes; E8-PO-ML3.5 sets 48 hours to patch drivers when vendors rate vulnerabilities critical or working exploits exist, a timeframe keyed to criticality and exploitation.