ASD ISM 1366 Ensure timely security updates for mobile devices
What it says
Security updates are applied to mobile devices as soon as they become available.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishApply security updates to mobile devices immediately upon availability to prevent security breaches.
This control is about making sure we update our mobile devices with the latest security fixes as soon as they're available. If we don't, we risk leaving our devices open to hackers who can exploit these security holes to access or steal our data.
Free. Save your status, tasks and notes.
Why it matters
Neglected mobile device updates can expose sensitive data to attackers exploiting known vulnerabilities, leading to data breaches and reputational damage.
How to implement
The IT team should set up alerts: Configure systems that notify the team immediately when a new security update for any mobile device is released.
Use software that automatically checks for updates daily and sends an alert via email or an app notification.
Business managers should plan: Allocate time each week for IT staff to apply these updates without disrupting business operations.
Schedule update sessions during off-peak hours to minimise impact on staff productivity.
The IT team should document everything: When an update is applied, record the date, time, and any issues encountered.
Use a simple spreadsheet or a dedicated software tool for tracking this information.
Train all employees: Organise a training session to explain the importance of security updates and how delays can lead to data theft or downtime.
Use real-world examples of breaches due to unpatched devices.
Review settings regularly: The IT team should check that all mobile devices are set to automatically accept updates if supported.
This involves going into each device's settings and toggling the auto-update feature.
Keep it running
Enable automatic OS/app updates via MDM and monitor compliance so mobile devices install security updates as soon as released.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
The update records: Request the logs or reports that show when updates were applied to mobile devices.
Look at
The dates and times to ensure they are timely.
Good evidence
Shows updates are applied immediately upon release, with minimal delay.
- Check 2 of 3What an auditor asks for
Look at
Settings labelled as automatic or scheduled updates.
Good evidence
Result shows these settings are consistently activated across devices.
- Check 3 of 3What an auditor asks for
Ask for
The alert system proof: Verify that the IT team has mechanisms in place for receiving update alerts. Check for configurations in monitoring software or email alert systems. Good practice is frequent and reliable update notifications.
Look at
Content about the risks of not updating. A thorough session is one where all employees have been informed and materials are kept current.
Good evidence
Policy is comprehensive, clear, and actively adhered to.
Mappings
Closest match in ISO/IEC 27001: A.8.8, Management of technical vulnerabilities, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1366 requires security updates to be applied to mobile devices as soon as they become available. ISO/IEC 27001:2022 Annex A 8.8 (configuration management for security) is broader in requiring organisations to obtain vulnerability information, assess exposure, and take appropriate measures across information systems generally, which includes patching as one possible treatment. ISM-1366 is a specific prescriptive measure (timely mobile-device updating) that would sit within an Annex A 8.8 vulnerability/configuration management program.
ASD Essential Eight: 1 mapping
This control partially overlaps E8-PA-ML3.1.
ISM-1366 requires security updates to be applied to mobile devices as soon as they become available. E8-PA-ML3.1 overlaps by mandating rapid patching (within 48 hours) for critical vulnerabilities in key application classes, which can include mobile applications where those products are in scope. However, ISM-1366 is device-specific and applies to all mobile device security updates (including OS and platform updates), while E8-PA-ML3.1 is application-category and severity/conditions driven rather than "as soon as available".
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.