ASD ISM 1163 Continuous monitoring plan to find and fix vulnerabilities
What it says
Systems have a continuous monitoring plan that includes: - conducting security assessment activities to identify vulnerabilities - analysing identified vulnerabilities to determine their potential impact - implementing mitigations based on risk, effectiveness and cost.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEach system must have a written continuous monitoring plan that covers three things: (1) running security assessment activities to find vulnerabilities (weaknesses an attacker could exploit), (2) analysing each vulnerability found to work out its potential impact, and (3) putting fixes (mitigations) in place, choosing which ones based on risk, how effective they are, and how much they cost. The goal is an ongoing cycle of find, assess, and fix, rather than a one-off security check.
Your systems need an ongoing routine for spotting and closing security holes, written down as a plan. The plan has to do three jobs. First, it keeps looking for weaknesses (this is called a security assessment, and includes things like vulnerability scans). Second, when a weakness is found, someone works out how bad it could be if a criminal used it, for example what data or services it puts at risk. Third, you fix the weaknesses, deciding what to fix first by weighing up the risk, whether the fix actually works, and what it costs. This matters because attackers constantly look for unpatched weaknesses, so a single yearly check is not enough. A continuous loop of finding, judging, and fixing keeps your defences current and stops small holes from turning into a major breach.
Free. Save your status, tasks and notes.
Why it matters
Without continuous monitoring, vulnerabilities go undetected and unfixed, giving attackers an open path to breach data, disrupt services, and cause costly damage.
How to implement
System owners should write a continuous monitoring plan for each system and have it cover all three required activities: finding vulnerabilities, analysing their impact, and implementing mitigations.
IT or security staff should schedule regular security assessment activities, such as automated vulnerability scans and periodic manual reviews, so new weaknesses are found on an ongoing basis rather than once a year.
Whoever runs the assessments should analyse each vulnerability found to determine its potential impact, recording what system, data, or service is at risk and how serious the consequences would be.
Decision makers should choose which mitigations to apply by weighing three factors together: the risk the vulnerability poses, how effective the proposed fix is, and how much it costs to implement.
System owners should keep the plan current by reviewing it on a set cadence and updating the schedule, scan coverage, and mitigation priorities as systems and threats change.
Keep it running
Treat finding, analysing, and fixing as one repeating loop, not three one-off tasks. Keep the plan and its assessment schedule current as systems and threats change.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Can you show me the documented continuous monitoring plan for this system?
Look at
A written plan that names all three activities (security assessments, impact analysis, risk-based mitigation). GOOD-ANSWER: A current, system-specific plan covering all three, with named owners and a schedule.
- Check 2 of 5What an auditor asks for
Ask for
How and how often do you run security assessment activities to find vulnerabilities?
Look at
Scan schedules, scan reports with dates, and records of manual reviews. GOOD-ANSWER: Regular, recurring assessments with dated evidence, not a single point-in-time check.
- Check 3 of 5What an auditor asks for
Ask for
How do you analyse a vulnerability once it is found to determine its impact?
Look at
Impact ratings or notes recording affected systems, data, and severity for each finding. GOOD-ANSWER: A consistent method that records potential impact for every vulnerability identified.
- Check 4 of 5What an auditor asks for
Ask for
How do you decide which mitigations to implement?
Look at
Records showing decisions weighed risk, effectiveness, and cost together. GOOD-ANSWER: Prioritisation that visibly balances all three factors, with high-risk items addressed first.
- Check 5 of 5What an auditor asks for
Ask for
Can you show evidence that planned mitigations were actually implemented?
Look at
Patch logs, change records, or remediation tickets tied to specific findings. GOOD-ANSWER: Completed fixes traceable back to the vulnerabilities they address, done in a timely way.
Mappings
Closest match in ASD Essential Eight: E8-PA-ML1.2, Up-to-date vulnerability scanner used for scanning activities, which this control covers in full and more.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.8.8.
ISM-1163 requires continuous monitoring including regular vulnerability assessments. Annex A 8.8 overlaps by demanding evaluation of technical vulnerabilities and appropriate countermeasures, though it lacks specific scanning schedules or penetration testing requirements.
ASD Essential Eight: 13 mappings
This control is broader than E8-PA-ML1.2.
E8-PA-ML1.2 requires organisations to use a vulnerability scanner with an up-to-date vulnerability database for vulnerability scanning activities. ISM-1163 is a broader continuous monitoring requirement that includes vulnerability scanning frequency, assessments/penetration testing, analysis of vulnerabilities, and implementing mitigations based on risk. E8-PA-ML1.2 fits within ISM-1163 as a specific tooling-quality expectation, but does not cover the wider monitoring, testing, analysis, and remediation lifecycle.
This control is broader than E8-PA-ML1.6.
E8-PA-ML1.6 requires applying non-critical patches for online services within two weeks where no working exploits exist. ISM-1163 establishes a continuous monitoring plan including regular vulnerability scanning, analysis of vulnerabilities, and implementing mitigations based on risk, which includes patching as a mitigation option. E8-PA-ML1.6 is a specific mitigation/timeliness requirement for a specific asset class, whereas ISM-1163 covers broader monitoring, testing, analysis and risk-based treatment across systems.
This control is broader than E8-PA-ML3.1.
E8-PA-ML3.1 requires organisations to rapidly remediate critical/exploited vulnerabilities in key applications within 48 hours of release. ISM-1163 supports this by requiring continuous monitoring activities (regular scanning, assessment and analysis) that help identify and prioritise vulnerabilities needing urgent patching. ISM-1163 is broader risk and assurance activity and does not itself impose the specific 48-hour patching timeframe for the specified application set.
This control is broader than E8-PO-ML1.3.
E8-PO-ML1.3 requires daily vulnerability scanning of internet-facing servers and network devices to identify missing OS patches or updates. ISM-1163 is broader, requiring a continuous monitoring plan, with at least fortnightly scanning, plus periodic and event-driven vulnerability assessments. E8-PO-ML1.3 fits within ISM-1163 as a specific scanning practice with a narrower focus and higher cadence.
This control is broader than E8-PO-ML3.1.
E8-PO-ML3.1 requires fortnightly vulnerability scanning specifically to identify missing patches or updates for vulnerabilities in drivers. ISM-1163 mandates a broader continuous monitoring plan that includes at least fortnightly scans, analysis of vulnerabilities, and risk-based mitigations (plus pre-deployment testing and annual penetration testing). E8-PO-ML3.1 aligns to only one element of ISM-1163 (regular scanning) and is narrower in both scope (drivers) and depth (no analysis/testing requirements).
This control partially meets E8-PO-ML1.1.
E8-PO-ML1.1 requires automated fortnightly asset discovery to ensure assets are identified for vulnerability scanning. ISM-1163 relates by mandating a broader continuous monitoring plan that includes conducting vulnerability scans at least fortnightly (plus assessments/pen tests, analysis, and risk-based mitigations). E8-PO-ML1.1 is a specific enabling activity within the wider vulnerability management lifecycle described by ISM-1163.
This control partially overlaps E8-PA-ML1.4.
ISM-1163 requires a continuous monitoring plan including regular vulnerability scanning and mitigation. E8-PA-ML1.4 relates by requiring weekly scanning to identify missing patches for specific applications, but does not cover penetration testing or comprehensive risk analysis.
This control partially overlaps E8-PA-ML2.2.
E8-PA-ML2.2 requires timely remediation by applying patches/mitigations for non-critical applications within one month of release. ISM-1163 overlaps by requiring continuous monitoring activities (including vulnerability scanning, assessment and analysis) and implementing mitigations based on risk, which includes patching as one mitigation option. ISM-1163 is broader and risk-driven (covers many vulnerability identification and treatment activities), while E8-PA-ML2.2 mandates a specific patching timeframe for a defined application subset.
This control partially overlaps E8-PO-ML1.4.
ISM-1163 mandates fortnightly system vulnerability scans and analysis for mitigation. E8-PO-ML1.4 aligns on scanning cadence, requiring fortnightly scanning to identify missing OS patches, but lacks broader assessment and mitigation processes mandated by ISM-1163.
This control supports E8-PA-ML1.1.
E8-PA-ML1.1 requires fortnightly automated asset discovery so an organisation can detect assets that need to be included in vulnerability scanning. ISM-1163 requires a continuous monitoring plan that includes at least fortnightly vulnerability scanning and broader assessment/testing activities. E8-PA-ML1.1 supports ISM-1163 by ensuring the scan scope is complete (including newly connected or unmanaged assets), but ISM-1163 extends well beyond discovery into scanning, assessment and remediation planning.
This control depends on E8-PO-ML1.5.
E8-PO-ML1.5 requires critical patches or vendor mitigations to be applied within 48 hours for internet-facing operating systems on servers and network devices when critical or exploited. ISM-1163 requires continuous monitoring activities (including frequent vulnerability scans, analysis, and implementing mitigations based on risk) that help identify and prioritise patching needs quickly. ISM-1163 does not set the same explicit 48-hour patch SLA for internet-facing OS, but it strengthens an organisation's ability to meet E8-PO-ML1.5 by improving detection and decision-making.
This control depends on E8-PO-ML3.5.
E8-PO-ML3.5 requires applying critical driver patches within 48 hours when vendors rate them critical or exploits exist. ISM-1163 establishes continuous monitoring activities (scanning, assessment, analysis and risk-based mitigation) that help identify affected systems and prioritise remediation. ISM-1163 supports timely execution and verification of E8-PO-ML3.5, but it does not itself mandate the specific 48-hour driver patch window.
- E8-PO-ML3.8Firmware vulnerabilities patched within one month if non-critical and no exploitsDepends on
This control depends on E8-PO-ML3.8.
E8-PO-ML3.8 requires timely remediation of non-critical firmware vulnerabilities within one month when no exploits exist. ISM-1163 supports this by requiring a continuous monitoring plan including regular vulnerability scans, analysis of identified vulnerabilities, and implementation of mitigations based on risk. ISM-1163 is broader continuous monitoring and risk treatment, while E8-PO-ML3.8 is a specific, time-bound firmware patching requirement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.