ASD ISM 0298 Centralised system patch and update management
What it says
A centralised and managed approach that maintains the integrity of patches or updates, and confirms that they have been applied successfully, is used to patch or update applications, operating systems, drivers and firmware.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure patches and updates are applied correctly using a centralised system for better security.
This control means that all your computers and systems should get updated in a systematic way from a central point. It's important because if these updates aren't managed properly, your business could be open to attacks that could harm your sensitive data or disrupt your operations.
Free. Save your status, tasks and notes.
Why it matters
Without a centralised patch and update process, patching becomes inconsistent, leaving unpatched OS, apps, drivers or firmware exposed to known vulnerabilities and outages.
How to implement
IT team should set up a centralised update platform: Choose and configure a software that can handle system updates for the entire organisation.
This software will automatically distribute and apply patches to all computers, reducing the risk of missing any important updates.
Managers should ensure staff compliance with update schedules: Communicate with staff about scheduled update times and ensure their devices are powered on and connected to the network during these times.
This minimises the chance of devices missing critical updates.
System owners should regularly review update logs: Check the centralised update platform for logs that detail which systems received updates and which did not.
This helps identify any systems that might have missed updates and need manual intervention.
IT team should conduct regular tests of the update process: Periodically verify the update process on sample systems to ensure updates are applied correctly.
This involves observing the update installation on a test device and confirming system operation post-update.
Management should develop a patch management policy: Create a written document detailing the update process, responsibilities, and protocols for dealing with failed updates.
Ensure this policy is easily accessible to all relevant staff and regularly reviewed.
Keep it running
Use a centralised patch service to source trusted updates, verify integrity/signatures, deploy to OS, apps, drivers and firmware, and centrally confirm success and exceptions.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The update logs from the centralised platform: Request logs showing all recent updates applied to the organisation's systems.
Look at
Clear records of updates installed and any noted failures.
Good evidence
Includes complete logs with no errors or skipped updates.
- Check 2 of 5What an auditor asks for
Good evidence
Is a detailed explanation of the centralised system, coverage of all devices, and monitoring statements.
- Check 3 of 5What an auditor asks for
Ask for
To observe when the IT team performs a system update across the network.
Look at
The speed and success of updates rolling out.
Good evidence
Is a smooth deployment with all systems reporting back as updated.
- Check 4 of 5What an auditor asks for
Look at
Clear procedures, responsible parties, and review schedules.
Good evidence
Includes a current document with management's sign-off.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of manual intervention when updates fail: Check records showing how failures were handled. This should include error logs and subsequent tasks to resolve issues.
Good evidence
Includes detailed follow-ups and successful resolutions.
Mappings
Closest match in ISO/IEC 27001: A.8.8, Management of technical vulnerabilities, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.8.
ISM-0298 mandates centralised patch management with integrity and successful application verification. Annex A 8.8 requires organisations to evaluate and address technical vulnerabilities, of which patching is one treatment, making ISM-0298 a specific operational control within its broader scope.
This control partially overlaps A.7.13.
Annex A 7.13 mandates correct maintenance of equipment to ensure the availability, integrity, and confidentiality of information. ISM-0298 overlaps by mandating centralised patch and update management for operating systems, applications, drivers, and firmware, which is a critical aspect of maintaining equipment to prevent failure and compromise. ISM-0298 focuses on patch integrity and deployment assurance, while Annex A 7.13 covers a broader range of maintenance activities, including servicing, repairs, and upkeep of physical assets.
ASD Essential Eight: 22 mappings
This control partially overlaps E8-AC-ML3.3.
E8-AC-ML3.3 requires implementing Microsoft's vulnerable driver blocklist to prevent execution of known vulnerable drivers. ISM-0298 requires a centralised, managed approach to patch or update applications, operating systems, drivers and firmware and to verify successful application. They overlap in managing driver-related risk, but E8-AC-ML3.3 is an execution-prevention control while ISM-0298 is a lifecycle maintenance/patching control that does not necessarily enforce runtime blocking.
- E8-PO-ML1.7One-month operating system patching for workstations, non-internet-facing servers and network devicesPartially overlaps
This control partially overlaps E8-PO-ML1.7.
E8-PO-ML1.7 requires operating system patches for workstations, non-internet-facing servers and non-internet-facing network devices to be applied within one month of release, while ISM-0298 requires a centralised, managed approach that maintains patch integrity and confirms successful installation when patching applications, operating systems, drivers and firmware. Both govern the application of operating system patches, but E8-PO-ML1.7 sets the deadline and ISM-0298 sets the delivery method and covers more software types.
This control partially overlaps E8-PO-ML1.8.
E8-PO-ML1.8 requires organisations to replace operating systems that are no longer supported by vendors. ISM-0298 overlaps by enforcing a centralised method for patching operating systems, a key practice for maintaining support before the end-of-support. However, it doesn't fully address the need for replacement where no upgrade path exists.
This control supports E8-PA-ML1.5.
E8-PA-ML1.5 requires critical patches or vendor mitigations for online services to be applied within 48 hours. ISM-0298 supports E8-PA-ML1.5 by mandating a centralised, managed patching approach that maintains patch integrity and confirms successful application across applications, operating systems, drivers and firmware. ISM-0298 is about the patch management capability and assurance, whereas E8-PA-ML1.5 is a specific time-bound requirement for critical online-service vulnerabilities.
This control supports E8-PA-ML1.7.
ISM-0298 requires a centralised and managed approach, which maintains patch integrity and confirms successful installation, to be used to patch applications, operating systems, drivers and firmware. E8-PA-ML1.7 requires patches for office productivity suites, web browsers and their extensions, email clients, PDF software and security products to be applied within two weeks of release, and depends on a managed approach like this to deploy those patches and confirm they were applied in time.
This control supports E8-PA-ML2.2.
E8-PA-ML2.2 requires patches, updates or other mitigations for vulnerabilities in non-critical applications to be applied within one month of release. ISM-0298 is a prerequisite enabler by requiring a centralised, managed approach to deliver patches/updates with integrity and confirmation of successful application. Without the capabilities in ISM-0298, consistently meeting the one-month patch timeframe in E8-PA-ML2.2 is significantly harder to assure at scale.
This control supports E8-PO-ML1.5.
E8-PO-ML1.5 requires organisations to apply critical patches to internet-facing operating systems on servers and network devices within 48 hours of release when critical or exploited. ISM-0298 requires a centralised, managed patching approach that preserves patch integrity and confirms successful deployment across applications, operating systems, drivers and firmware. Implementing ISM-0298 provides the operational mechanism (distribution and verification) that is typically prerequisite to consistently meeting E8-PO-ML1.5's 48-hour timeframe at scale.
This control supports E8-PO-ML3.3.
E8-PO-ML3.3 requires critical OS patches on workstations, non-internet-facing servers and non-internet-facing network devices to be applied within 48 hours when vendors rate them critical or working exploits exist. ISM-0298 establishes the centralised, managed patching capability (including integrity and verification of successful deployment) that is typically required to consistently meet that 48-hour SLA at scale. ISM-0298 is broader across asset types (applications, drivers and firmware as well as OS) but does not itself set the 48-hour criticality requirement that E8-PO-ML3.3 mandates.
This control supports E8-PO-ML3.5.
E8-PO-ML3.5 requires critical driver patches to be applied within 48 hours of release when rated critical or when exploits exist. ISM-0298 requires a centralised, managed patching approach that preserves patch integrity and confirms successful application across applications, operating systems, drivers and firmware. In practice, achieving the 48-hour driver patch SLA in E8-PO-ML3.5 at scale typically depends on having the centralised patch management capability mandated by ISM-0298, though ISM-0298 does not set the 48-hour timeframe.
This control supports E8-PO-ML3.6.
E8-PO-ML3.6 requires organisations to apply vendor mitigations for non-critical driver vulnerabilities within one month where no working exploits exist. ISM-0298 provides the enabling mechanism for this by requiring a centralised, managed approach to patching/updating drivers (including integrity assurance and confirmation of successful application). Without ISM-0298-style tooling and verification, meeting the one-month driver patch deadline in E8-PO-ML3.6 at scale is difficult to evidence.
This control supports E8-PO-ML3.7.
E8-PO-ML3.7 requires organisations to apply critical firmware patches within 48 hours when vendor criticality or working exploits indicate urgent risk. ISM-0298 requires a centralised, managed approach to patching (including firmware) that maintains patch integrity and confirms successful application, which is a practical prerequisite for reliably achieving 48-hour firmware patch SLAs at scale. E8-PO-ML3.7 sets the timeframe requirement, while ISM-0298 establishes the operational mechanism to deliver and verify it.
This control depends on E8-PA-ML1.3.
E8-PA-ML1.3 requires daily scanning to identify missing patches or updates for vulnerabilities in online services. ISM-0298 requires a centralised and managed approach to patching that maintains integrity and confirms successful application, which helps remediate the gaps identified by E8-PA-ML1.3. The controls complement each other: E8-PA-ML1.3 finds missing patches, while ISM-0298 strengthens consistent deployment and verification of those patches.
This control depends on E8-PA-ML1.4.
E8-PA-ML1.4 requires weekly vulnerability scanning to identify missing patches or updates in key software categories. ISM-0298 requires a centralised and managed approach to deploy patches/updates with integrity and confirmation of successful application. E8-PA-ML1.4 supports ISM-0298 by supplying regular, scanner-derived evidence of what is missing, while ISM-0298 focuses on the controlled distribution and verification of patching rather than detection frequency.
This control depends on E8-PA-ML1.6.
E8-PA-ML1.6 requires timely application of non-critical patches for vulnerabilities in online services within two weeks when no working exploits exist. ISM-0298 supports this by requiring a centralised, managed approach that preserves patch integrity and confirms successful application, which improves reliability and auditability of patching for online services. ISM-0298 is broader across multiple asset types (applications, operating systems, drivers and firmware), whereas E8-PA-ML1.6 is specific to online services and a two-week window.
This control depends on E8-PA-ML2.1.
E8-PA-ML2.1 requires fortnightly vulnerability scanning to identify missing patches for non-core applications. ISM-0298 requires a centralised, managed approach to deliver patches/updates with integrity and confirmation of successful application across applications and platforms. E8-PA-ML2.1 supports ISM-0298 by generating authoritative patch gap data that can be fed into centralised patch workflows, but it does not itself manage or confirm patch deployment.
This control depends on E8-PA-ML3.1.
E8-PA-ML3.1 requires rapid deployment of patches/mitigations within 48 hours for critical or exploited vulnerabilities in high-risk end-user applications and security products. ISM-0298 requires a centralised, managed patching approach that maintains patch integrity and confirms successful application, which supports the speed and assurance required to reliably deliver and prove the 48-hour application patching outcome. ISM-0298 is broader across technology types (applications, operating systems, drivers, firmware) and is enablement-focused rather than prescribing the E8-specific urgency trigger and scope.
This control depends on E8-PO-ML1.3.
E8-PO-ML1.3 requires daily scanning of internet-facing servers and network devices to identify missing OS patches or updates. ISM-0298 requires a centralised, managed patching approach to ensure integrity and confirm success. The scanner output from E8-PO-ML1.3 feeds and validates the patching lifecycle in ISM-0298, focusing on applied and verified patches.
This control depends on E8-PO-ML1.4.
E8-PO-ML1.4 requires fortnightly vulnerability scanning to identify missing OS patches on internal systems. ISM-0298 requires a centralised, managed patch/update approach that maintains integrity and confirms successful application across applications, operating systems, drivers and firmware. Scanner results from E8-PO-ML1.4 can feed and validate ISM-0298's patch process, but E8-PO-ML1.4 does not itself establish patch governance or confirmation of deployment success.
This control depends on E8-PO-ML3.1.
E8-PO-ML3.1 requires fortnightly vulnerability scanning to identify missing driver patches or updates. ISM-0298 requires a centralised, managed patching approach for applications, operating systems, drivers and firmware, including integrity and confirmation of successful application. The scan results from E8-PO-ML3.1 directly feed and strengthen ISM-0298 by identifying driver patch gaps to be remediated, but E8-PO-ML3.1 does not itself mandate patch deployment controls.
This control depends on E8-PO-ML3.2.
E8-PO-ML3.2 requires organisations to run fortnightly vulnerability scanning to find missing firmware patches and updates. ISM-0298 supports this by requiring a centralised, managed approach to apply patches/updates (including firmware) and confirm successful application, which helps remediate issues E8-PO-ML3.2 identifies. E8-PO-ML3.2 focuses on detection cadence, whereas ISM-0298 focuses on controlled deployment and verification of patching.
This control depends on E8-PO-ML3.4.
E8-PO-ML3.4 requires that organisations achieve timely OS patching (within one month) for specific internal device classes when vulnerabilities are non-critical and not exploited. ISM-0298 establishes the centralised patch and update management capability to distribute patches reliably and confirm successful application across operating systems and other components. ISM-0298 supports E8-PO-ML3.4 by providing the mechanism and assurance to consistently meet the one-month patching requirement, but it does not itself set the same conditional timeframe for non-critical OS vulnerabilities.
- E8-PO-ML3.8Firmware vulnerabilities patched within one month if non-critical and no exploitsDepends on
This control depends on E8-PO-ML3.8.
E8-PO-ML3.8 requires applying firmware vulnerability patches/mitigations within one month under specified conditions (non-critical and no exploit). ISM-0298 supports this by mandating a centralised, managed patching approach that maintains patch integrity and confirms successful application, including for firmware. ISM-0298 addresses the mechanism/governance of patch delivery and assurance, while E8-PO-ML3.8 sets a specific firmware remediation timeframe and trigger conditions.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-06.2Apply security patches within risk-based timeframes and automate low-impact updatesPartially overlaps
This control partially overlaps IT.PRO-06.2.
IT.PRO-06.2 requires security patches or updates to be applied within defined risk-based timeframes; ISM-0298 supports it by requiring a centralised, managed patching approach that maintains patch integrity and confirms patches were applied successfully.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.