Essential Eight PO-ML3.9 The latest or previous OS release is used
What it says
The latest release, or the previous release, of operating systems are used.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure your operating system is up-to-date with the latest or previous version.
Keeping your operating system on the latest or one version behind ensures it's protected against known security threats. If you don't keep up with updates, cybercriminals could exploit vulnerabilities to gain unauthorised access to your data.
Free. Save your status, tasks and notes.
Why it matters
Using unsupported OS releases increases exposure to known vulnerabilities, enabling compromise and unauthorised access to sensitive data.
How to implement
IT team should ensure all computers are running the latest or the previous version of their operating system by scheduling regular updates and confirming rollouts are successful.
System administrators need to verify the operating system version on a quarterly basis by reviewing system update logs and cross-checking with current vendor releases.
The IT manager should set up automatic notifications for new operating system releases so they can plan for updates promptly.
Security officers should implement a policy to replace any devices that can no longer support the latest or previous operating system version.
System administrators should regularly back up systems before performing operating system updates to prevent data loss during the update process.
Keep it running
Regularly audit endpoints and servers to confirm they run the latest or previous OS release, and schedule upgrades before vendor support ends.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Which operating system versions are currently in use across the organisation?
Look at
Review system update logs and device inventories to confirm operating systems are recent.
Good evidence
The organisation uses the latest or previous operating system release for all devices.
- Check 2 of 2What an auditor asks for
Ask for
How does the organisation stay informed about new operating system releases?
Look at
Check for notifications setup or policies in place for tracking operating system updates.
Good evidence
The organisation receives vendor notifications and has policies for timely updates.
Mappings
Closest match in ASD Information Security Manual: ISM-1407, Ensure use of current OS versions, which asks for the same thing.
ASD Information Security Manual: 5 mappings
This control is equivalent to ISM-1407.
E8-PO-ML3.9 requires organisations to use the latest release, or the previous release, of operating systems. ISM-1407 states the same requirement using the same wording and intent. Both controls focus on keeping OS versions current (not merely patched) to reduce exposure to unaddressed vulnerabilities and loss of vendor support.
This control partially overlaps ISM-1483.
ISM-1483 requires internet-facing server applications to be kept at their latest release. E8-PO-ML3.9 relates by requiring operating systems to be on the latest or previous release, which is the equivalent currency concept but applied to OS rather than server applications. Both reduce risk by avoiding old, vulnerable versions, but they cover different layers (application versus OS) and have different specificity about internet-facing exposure.
This control partially overlaps ISM-1501.
E8-PO-ML3.9 requires organisations to use the latest or previous OS release. ISM-1501 requires replacing operating systems that are no longer supported by vendors, which often drives upgrades and aligns with staying current. However, E8-PO-ML3.9 can require upgrading even when a vendor still supports older releases, while ISM-1501 does not explicitly require being on latest/previous-only supported.
- ISM-1848Replace unsupported software-based isolation mechanisms sharing physical resourcesPartially overlaps
This control partially overlaps ISM-1848.
E8-PO-ML3.9 requires organisations to use the latest or previous OS release. ISM-1848 requires that, in virtualised/server isolation contexts, the isolation mechanism or underlying OS is replaced when it is no longer vendor-supported, which supports keeping foundational platforms current. The overlap is limited to operating system lifecycle management; ISM-1848 is narrower to isolation mechanisms and focuses on support status rather than the latest/previous release criterion.
This control depends on ISM-1605.
ISM-1605 requires that the underlying host operating system is hardened when using software-based isolation to share physical server hardware in virtual environments. E8-PO-ML3.9 supports this by ensuring the OS is a current (latest or previous) release, which is a foundational prerequisite for applying and sustaining effective hardening guidance and security baselines. However, E8-PO-ML3.9 is about platform currency, while ISM-1605 is about hardening configuration specifically for secure virtualisation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.