Essential Eight PO-ML3.6 Apply non-critical driver patches within one month
What it says
Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure drivers are updated within a month if the vulnerabilities are non-critical and no exploits exist.
This control is about keeping your computer drivers updated with patches that fix known vulnerabilities, even though they are not critical. By doing so, you prevent potential security threats that could, over time, be exploited by cybercriminals. It's like fixing small leaks in your house before they become bigger problems.
Free. Save your status, tasks and notes.
Why it matters
Failure to patch non-critical drivers within one month can enable later exploitation if a vuln gains a working exploit.
How to implement
IT team should regularly review vendor announcements.
This can be done by subscribing to security bulletins on the manufacturer's website to stay informed about new non-critical driver patches.
System administrators should schedule monthly updates.
They can use automated patch management tools to ensure drivers are updated within one month of a patch release.
Security officer should assess non-critical vulnerabilities.
This involves evaluating vendor-provided information and ensuring there are no active exploits before classifying patches as non-critical.
IT support staff should configure alerts in the system management tool.
This helps them monitor for available patches and apply them promptly within the specified time frame.
Keep it running
Track non-critical driver patches and schedule deployment within one month to prevent backlog and drift.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
How often does the organisation check for driver updates?
Look at
Inspect logs or emails summarising vendor announcements.
Good evidence
Reviews occur at least monthly, with documented evidence of checks.
- Check 2 of 3What an auditor asks for
Ask for
How are drivers updated?
Look at
Examine the settings of the patch management system or software used.
Good evidence
The system is configured to automatically apply non-critical patches within one month.
- Check 3 of 3What an auditor asks for
Ask for
What criteria are used to assess the criticality of driver vulnerabilities?
Look at
Review internal documentation on vulnerability assessment process.
Good evidence
Clear guidelines exist that align with vendor classifications and threat assessments.
Mappings
Closest match in ASD Information Security Manual: ISM-1697, Apply non-critical patches within one month, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.8.
E8-PO-ML3.6 requires organisations to apply non-critical driver patches within one month when no working exploits exist. ISO/IEC 27001:2022 Annex A 8.8 requires obtaining information about technical vulnerabilities, evaluating exposure, and taking appropriate measures, which commonly includes patching as a treatment. E8-PO-ML3.6 is a prescriptive subset of Annex A 8.8 focused on a specific asset class (drivers) and a defined remediation window under defined conditions.
This control supports A.5.7.
E8-PO-ML3.6 requires organisations to patch non-critical driver vulnerabilities within one month when no working exploits exist. ISO/IEC 27001:2022 Annex A 5.7 supports this by driving collection and analysis of threat information that can inform whether exploit code exists or is emerging for driver vulnerabilities, affecting how the E8-PO-ML3.6 condition is assessed. Annex A 5.7 does not mandate patch deployment timeframes, but improves the quality of decisions behind E8-PO-ML3.6's exploit-based condition.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.6.2.6.
Annex A 6.2.6 requires the organisation to define and document ongoing AI system operation including repairs, updates and support. E8-PO-ML3.6 overlaps by specifying a patching timeliness requirement for non-critical driver vulnerabilities, which is one concrete form of update/repair activity that may be needed to keep AI systems and their platforms secure and stable. E8-PO-ML3.6 is narrowly scoped to drivers and security vulnerabilities, while Annex A 6.2.6 covers broader AI system updates (including model/runtime changes) and operational support arrangements.
ASD Information Security Manual: 4 mappings
This control is equivalent to ISM-1697.
ISM-1697 requires organisations to apply patches, updates or other vendor mitigations for non-critical driver vulnerabilities within one month where no working exploits exist. E8-PO-ML3.6 states the same patching requirement with the same scope (drivers), timing (one month), and conditions (non-critical, no working exploits). Implementing E8-PO-ML3.6 would therefore largely satisfy ISM-1697.
This control partially overlaps ISM-1904.
ISM-1904 requires vendor firmware patches/updates/mitigations to be applied within one month when vulnerabilities are non-critical and there are no working exploits. E8-PO-ML3.6 applies the same concept and timing, but for drivers rather than firmware. They align on the patching principle and SLA, but differ materially in technical scope (firmware vs drivers).
This control depends on ISM-0298.
E8-PO-ML3.6 requires organisations to apply vendor mitigations for non-critical driver vulnerabilities within one month where no working exploits exist. ISM-0298 provides the enabling mechanism for this by requiring a centralised, managed approach to patching/updating drivers (including integrity assurance and confirmation of successful application). Without ISM-0298-style tooling and verification, meeting the one-month driver patch deadline in E8-PO-ML3.6 at scale is difficult to evidence.
This control depends on ISM-1143.
E8-PO-ML3.6 requires organisations to deploy non-critical driver patches within one month when no working exploits exist. ISM-1143 underpins this by requiring patch management processes and supporting procedures to be developed, implemented and maintained (e.g. triage, scheduling, exceptions, and compliance tracking). E8-PO-ML3.6 is a specific timing/condition requirement, while ISM-1143 is the governance/process prerequisite that makes consistent execution and auditability possible.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-06.2Apply security patches within risk-based timeframes and automate low-impact updatesPartially overlaps
This control partially overlaps IT.PRO-06.2.
IT.PRO-06.2 requires security patches to be applied within risk-based timeframes; E8-PO-ML3.6 sets one month to patch drivers when vendors rate vulnerabilities non-critical and no working exploits exist, one specific case of that.
- IT.PRO-06.3Remediate or mitigate above-threshold vulnerabilities within defined timeframes and verify effectivenessPartially overlaps
This control partially overlaps IT.PRO-06.3.
IT.PRO-06.3 requires vulnerabilities above risk thresholds to be remediated or mitigated in set timeframes; E8-PO-ML3.6 sets one month to patch drivers when vendors rate vulnerabilities non-critical and no working exploits exist, a timeframe keyed to criticality and exploitation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.