ASD ISM 1407 Ensure use of current OS versions
What it says
The latest release, or the previous release, of operating systems are used.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse the latest or previous operating system version to keep systems up-to-date.
Keeping your computer systems up-to-date by using the latest or just the previous release of an operating system is like ensuring that your team has the best tools available. It matters because outdated systems can have vulnerabilities that are not fixed, making it easier for cybercriminals to break in and potentially cause damage or steal information.
Free. Save your status, tasks and notes.
Why it matters
Using outdated OS versions leaves known vulnerabilities unpatched, increasing the likelihood of compromise and data breaches.
How to implement
IT team should monitor system updates: They need to regularly check for new operating system versions released by vendors like Microsoft or Apple.
This can be done by subscribing to vendor newsletters or setting up alerts on technology news sites.
System owner should plan upgrades: Work with the IT team to create a schedule for upgrading systems to the latest stable version of the operating system.
Consider doing this during low-usage periods to minimise disruption.
Managers should allocate resources: Ensure enough time and budget is earmarked for regular operating system upgrades.
This involves coordinating with finance to support any hardware compatibility needs.
IT team should test updates: Before rolling out a new operating system version, the IT team should test it on a small group of computers to ensure compatibility with essential applications.
Use testing labs or virtual environments to conduct these trials.
Staff training should be conducted by education officers: Organise training sessions for staff to familiarise them with new features or changes in the updated operating system.
Use user guides and webinars to assist with this.
Keep it running
Maintain OS currency by standardising on the latest or previous release, tracking vendor lifecycle dates, and scheduling upgrades before end-of-support.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The operating system update policy: Request a document that outlines the process for keeping systems up-to-date.
Look at
Whether it specifies timelines and responsibilities.
Good evidence
Clearly allocates responsibilities and provides a schedule.
- Check 2 of 5What an auditor asks for
Ask for
The upgrade schedule: Request to see the planned schedule for system upgrades.
Look at
Dates and systems targeted for each upgrade phase.
Good evidence
Contains a timeline with completed and upcoming upgrades clearly marked.
- Check 3 of 5What an auditor asks for
Ask for
To see update notifications: Request the alerts or notifications from operating system vendors that the IT team receives.
Look at
Whether these show the latest available operating system versions.
Good evidence
Includes recent alerts about new releases.
- Check 4 of 5What an auditor asks for
Ask for
The change management log: Request a log of changes made to the operating systems, including updates.
Look at
Dates, system names, and approval signatures.
Good evidence
Has a well-documented record corresponding to the schedule.
- Check 5 of 5What an auditor asks for
Ask for
To interview IT staff: Conduct an interview to understand the process for handling system updates.
Look at
Clear explanations of testing, approvals, and rollouts.
Good evidence
Is consistent with documented policies and practices.
Mappings
Closest match in ASD Essential Eight: E8-PO-ML3.9, The latest or previous OS release is used, which asks for the same thing.
ASD Essential Eight: 3 mappings
This control is equivalent to E8-PO-ML3.9.
E8-PO-ML3.9 requires organisations to use the latest release, or the previous release, of operating systems. ISM-1407 states the same requirement using the same wording and intent. Both controls focus on keeping OS versions current (not merely patched) to reduce exposure to unaddressed vulnerabilities and loss of vendor support.
This control partially overlaps E8-PO-ML1.5.
ISM-1407 requires organisations to stay on the latest or previous OS release to reduce exposure to known vulnerabilities and maintain vendor currency. E8-PO-ML1.5 requires applying critical OS patches to internet-facing systems within 48 hours, which is a patch-timeliness requirement rather than a version-currency requirement. They intersect because current OS releases are more likely to receive timely patches, but each control has distinct obligations (version selection vs patch SLAs).
This control partially overlaps E8-PO-ML1.8.
ISM-1407 requires organisations to use only the latest or previous operating system releases. E8-PO-ML1.8 focuses on replacing operating systems that are no longer vendor-supported, which commonly drives upgrades but does not necessarily enforce 'latest or previous' where older supported releases still exist. The controls overlap on avoiding obsolete OSs, but ISM-1407 is stricter and version-specific while E8-PO-ML1.8 is framed around vendor support status.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.