Essential Eight PO-ML3.8 Firmware vulnerabilities patched within one month if non-critical and no exploits
What it says
Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishApply patches for non-critical firmware vulnerabilities within a month if no exploits exist.
This control is about making sure that any weaknesses found in your computer's core software, known as firmware, are fixed within a month if they aren't urgent and no one has figured out how to exploit them yet. If you don't patch these weaknesses, hackers might find a way to attack your systems down the line, putting your business at risk.
Free. Save your status, tasks and notes.
Why it matters
If non-critical firmware fixes are delayed beyond one month, new exploits may emerge, leaving devices exposed and risking outages or integrity compromise.
How to implement
IT team should review firmware updates monthly.
Do this by checking the manufacturer's website or firmware update tools for announcements.
IT team should assess the criticality of each firmware vulnerability.
Use vendor guidance to determine if a vulnerability is considered non-critical.
System administrator should apply available firmware patches.
Follow the vendor's instructions to ensure the update is applied correctly and documented.
Security officer should maintain a schedule for regular firmware updates.
Set reminders each month to check for and apply any pending updates.
IT team should monitor for news of exploits related to firmware.
Use security bulletins from trusted sources to stay informed about any new threats.
Keep it running
Track firmware vendor advisories and exploit status; for non-critical issues with no working exploit, schedule and apply patches/mitigations within 30 days.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
What is your process for checking and applying firmware updates?
Look at
Examine the logs or records of firmware updates applied in the past 12 months.
Good evidence
The organisation should present a detailed update schedule showing monthly checks, assessments, and application of non-critical firmware patches.
- Check 2 of 2What an auditor asks for
Ask for
How do you determine if a firmware vulnerability is non-critical?
Look at
Review vendor documentation or internal vulnerability assessment criteria.
Good evidence
The organisation should have a documented process that aligns with vendor severity ratings and exploit status checks.
Mappings
Closest match in ASD Information Security Manual: ISM-1904, Apply firmware patches for non-critical vulnerabilities, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
E8-PO-ML3.8 requires a specific action: apply vendor mitigations for non-critical firmware vulnerabilities within one month when no working exploits exist. Annex A 8.8 requires organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures across information systems generally. E8-PO-ML3.8 is a concrete, narrowly scoped implementation (firmware, defined conditions, defined timeframe) that fits within the broader vulnerability management expectations of Annex A 8.8.
ISO/IEC 42001: 1 mapping
This control partially overlaps A.6.2.6.
Annex A 6.2.6 requires documented processes for operating and maintaining the AI system, including updates and repairs. E8-PO-ML3.8 overlaps by requiring timely patching of non-critical firmware vulnerabilities, which is part of maintaining the underlying infrastructure that AI systems depend on. E8-PO-ML3.8 is limited to firmware vulnerability remediation, whereas Annex A 6.2.6 extends to end-to-end AI system operation (including performance monitoring and support) beyond infrastructure patching.
ASD Information Security Manual: 8 mappings
This control is equivalent to ISM-1904.
E8-PO-ML3.8 requires patches, updates, or vendor mitigations for non-critical firmware vulnerabilities to be applied within one month when no working exploits exist. ISM-1904 states the same firmware patching timeframe and the same conditions (non-critical vendor assessment and no working exploits). The scope (firmware), trigger conditions, and required timeframe align closely such that implementing one would largely satisfy the other.
This control partially meets ISM-1143.
E8-PO-ML3.8 requires organisations to apply non-critical firmware vulnerability patches within one month when no working exploits exist. ISM-1143 supports this by requiring documented and maintained patch management processes and procedures, which underpin consistent execution and tracking of the one-month firmware patch window. ISM-1143 is procedural and governance-focused, whereas E8-PO-ML3.8 is a specific operational requirement for firmware vulnerabilities.
This control partially overlaps ISM-0300.
ISM-0300 requires that vulnerabilities in high assurance IT equipment are remediated via patches/updates/mitigations only when approved by ASD and in ASD-directed timeframes. E8-PO-ML3.8 requires applying non-critical firmware patches within one month when no exploits exist, which can be part of maintaining high assurance equipment. They overlap on firmware patching activity, but ISM-0300 is driven by ASD approval and prescribed processes rather than the vendor's non-critical classification and a fixed one-month window.
This control partially overlaps ISM-1697.
ISM-1697 requires organisations to apply non-critical patches for driver vulnerabilities within one month when no working exploits exist. E8-PO-ML3.8 applies the same timing and exploit/criticality conditions, but for firmware rather than drivers. They overlap on the general patch-timeliness principle, but differ materially in asset class and technical scope.
This control partially overlaps ISM-1903.
E8-PO-ML3.8 requires organisations to apply vendor mitigations for non-critical firmware vulnerabilities within one month when there are no working exploits. ISM-1903 addresses the same firmware vulnerability remediation activity but for critical vulnerabilities or those with working exploits and requires action within 48 hours. They overlap on the firmware patch/mitigation process but differ in triggers and urgency (non-critical/no exploit vs critical/exploit and 1 month vs 48 hours).
This control supports ISM-0298.
E8-PO-ML3.8 requires applying firmware vulnerability patches/mitigations within one month under specified conditions (non-critical and no exploit). ISM-0298 supports this by mandating a centralised, managed patching approach that maintains patch integrity and confirms successful application, including for firmware. ISM-0298 addresses the mechanism/governance of patch delivery and assurance, while E8-PO-ML3.8 sets a specific firmware remediation timeframe and trigger conditions.
This control supports ISM-1163.
E8-PO-ML3.8 requires timely remediation of non-critical firmware vulnerabilities within one month when no exploits exist. ISM-1163 supports this by requiring a continuous monitoring plan including regular vulnerability scans, analysis of identified vulnerabilities, and implementation of mitigations based on risk. ISM-1163 is broader continuous monitoring and risk treatment, while E8-PO-ML3.8 is a specific, time-bound firmware patching requirement.
This control depends on ISM-1900.
E8-PO-ML3.8 requires organisations to remediate non-critical firmware vulnerabilities within one month when no working exploits exist. ISM-1900 supports this by requiring at least fortnightly vulnerability scanning to identify missing firmware patches/updates, helping organisations detect what needs to be applied to meet the one-month deadline. ISM-1900 is about identification and verification of missing firmware patches rather than the remediation timeframe itself.
ASD Essentials for enterprise IT: 2 mappings
- IT.PRO-06.2Apply security patches within risk-based timeframes and automate low-impact updatesPartially overlaps
This control partially overlaps IT.PRO-06.2.
IT.PRO-06.2 requires security patches to be applied within risk-based timeframes; E8-PO-ML3.8 sets one month to patch firmware when vendors rate vulnerabilities non-critical and no working exploits exist, one specific case of that.
- IT.PRO-06.3Remediate or mitigate above-threshold vulnerabilities within defined timeframes and verify effectivenessPartially overlaps
This control partially overlaps IT.PRO-06.3.
IT.PRO-06.3 requires vulnerabilities above risk thresholds to be remediated or mitigated in set timeframes; E8-PO-ML3.8 sets one month to patch firmware when vendors rate vulnerabilities non-critical and no working exploits exist, a timeframe keyed to criticality and exploitation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.