Essential Eight PO-ML3.7 Apply critical firmware patches within 48 hours
What it says
Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure firmware vulnerabilities are fixed quickly, within 48 hours if critical.
This control is about fixing critical security problems in the firmware of your equipment within 48 hours. If these updates aren't applied quickly, cybercriminals could exploit these weaknesses to access sensitive data or disrupt your business. Applying these patches promptly helps keep your systems secure.
Free. Save your status, tasks and notes.
Why it matters
Delaying critical firmware patches beyond 48 hours can leave devices exposed to known exploits, enabling compromise and disruption of services.
How to implement
IT team should monitor firmware updates daily by subscribing to vendor security newsletters or alerts, ensuring they are aware of any newly released critical updates.
System administrator needs to create a process to apply critical firmware updates within 48 hours by setting up automated alerts when critical patches are released and scheduling immediate maintenance windows.
Security officer should prioritise the review and application of firmware patches by assessing the patch's criticality using trusted security advisories, ensuring a focus on those with working exploits.
Office manager should ensure that all key IT staff are trained and aware of the importance of timely firmware patching by organising regular training sessions and drills.
IT team should have a backup plan ready before applying new firmware updates by performing system backups to avoid data loss if there is an issue with the update.
Keep it running
Track vendor firmware advisories and exploit intel; prioritise critical updates and apply within 48 hours, with testing and rollback plans for devices.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
How does your organisation track and receive notifications about new critical firmware updates?
Look at
Review alert subscription or monitoring system used by the organisation.
Good evidence
The organisation subscribes to multiple vendor alerts and cyber security bulletins for timely notifications.
- Check 2 of 3What an auditor asks for
Ask for
What is the process for applying critical firmware updates within 48 hours?
Look at
Examine the documented procedures and schedules for update application.
Good evidence
There is a documented procedure that includes steps for immediate application of updates upon release.
- Check 3 of 3What an auditor asks for
Ask for
How do you ensure that updates are applied correctly and promptly across all devices?
Look at
Verify recent logs or records of firmware updates applied to systems.
Good evidence
Logs show updates being applied within the required timeframe for all critical releases.
Mappings
Closest match in ASD Information Security Manual: ISM-1903, Rapid application of critical firmware patches, which asks for the same thing.
ASD Information Security Manual: 7 mappings
This control is equivalent to ISM-1903.
E8-PO-ML3.7 requires organisations to apply critical firmware patches (or vendor mitigations) within 48 hours when rated critical by the vendor or when working exploits exist. ISM-1903 states the same 48-hour requirement for critical firmware vulnerabilities under the same triggering conditions. The scope (firmware), urgency (48 hours) and decision criteria (vendor criticality/working exploit) align closely enough that implementing one would largely satisfy the other.
This control partially overlaps ISM-1697.
ISM-1697 requires applying non-critical driver patches within one month when no working exploits exist. E8-PO-ML3.7 requires patching firmware vulnerabilities within 48 hours when they are critical or when working exploits exist. The overlap is limited to the general patch/mitigation concept, with key differences in both asset type (firmware vs drivers) and urgency/risk trigger (critical/exploited vs non-critical/non-exploited).
This control partially overlaps ISM-1754.
ISM-1754 requires vulnerabilities identified in software to be resolved in a timely manner. E8-PO-ML3.7 mandates applying critical firmware patches within 48 hours, which overlaps with ISM-1754 where firmware is treated as software within the organisation's remediation scope. E8-PO-ML3.7 is more specific (firmware and 48-hour SLA), while ISM-1754 is broader in intent but not limited to firmware.
This control partially overlaps ISM-1876.
ISM-1876 requires critical patches or mitigations for vulnerabilities in online services within 48 hours when vendors rate them critical or when working exploits exist. E8-PO-ML3.7 applies the same urgency and triggers to firmware vulnerabilities. They share the same patching timeliness requirement, but address different asset categories (online services versus firmware).
This control partially overlaps ISM-1904.
ISM-1904 requires applying firmware patches within one month when vulnerabilities are non-critical and no working exploits exist. E8-PO-ML3.7 covers firmware patching as well, but for critical vulnerabilities or where working exploits exist, requiring action within 48 hours. They share the same technology domain (firmware patching) but apply to different severity/exploit conditions and timelines.
This control depends on ISM-0298.
E8-PO-ML3.7 requires organisations to apply critical firmware patches within 48 hours when vendor criticality or working exploits indicate urgent risk. ISM-0298 requires a centralised, managed approach to patching (including firmware) that maintains patch integrity and confirms successful application, which is a practical prerequisite for reliably achieving 48-hour firmware patch SLAs at scale. E8-PO-ML3.7 sets the timeframe requirement, while ISM-0298 establishes the operational mechanism to deliver and verify it.
This control depends on ISM-1143.
E8-PO-ML3.7 requires organisations to apply critical firmware patches or mitigations within 48 hours when vendor criticality or working exploits exist. ISM-1143 requires patch management processes and procedures to be developed, implemented and maintained, which underpin how the organisation identifies firmware patches, assesses urgency, schedules deployment and verifies completion within mandated timeframes. E8-PO-ML3.7 is the specific performance outcome, while ISM-1143 provides the governance and repeatability needed to meet it consistently.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-06.2Apply security patches within risk-based timeframes and automate low-impact updatesPartially overlaps
This control partially overlaps IT.PRO-06.2.
IT.PRO-06.2 requires security patches to be applied within risk-based timeframes; E8-PO-ML3.7 sets 48 hours to patch firmware when vendors rate vulnerabilities critical or working exploits exist, one specific case of that.
- IT.PRO-06.3Remediate or mitigate above-threshold vulnerabilities within defined timeframes and verify effectivenessPartially overlaps
This control partially overlaps IT.PRO-06.3.
IT.PRO-06.3 requires vulnerabilities above risk thresholds to be remediated or mitigated in set timeframes; E8-PO-ML3.7 sets 48 hours to patch firmware when vendors rate vulnerabilities critical or working exploits exist, a timeframe keyed to criticality and exploitation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.