ASD ISM 1467 Use latest releases of user applications
What it says
The latest release of email clients, office productivity suites, PDF applications, security products and web browsers, including their extensions, are used.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure all user applications like email and web browsers are updated to their latest versions.
Keeping user applications like email and web browsers updated to their latest versions is crucial because it protects against security flaws. If these apps are outdated, they can be an easy target for cybercriminals, potentially leading to breaches of sensitive business or personal information.
Free. Save your status, tasks and notes.
Why it matters
Neglecting to update applications invites cyber threats, risking data breaches that could harm business finances and reputation.
How to implement
IT team should check regularly for updates to all user applications.
This means setting up automatic updates where possible or tracking release notifications from application providers.
System owner should ensure that all employees understand the importance of updates.
They could organise a short workshop or send an informative email explaining the risks of using outdated applications.
Managers should create a policy for regular updates.
This involves drafting a simple document that outlines how often updates should occur and the responsibilities of staff.
The IT team should use a centralised management tool to deploy updates.
This helps to automate and streamline the installation of updates, ensuring no application is overlooked.
System administrators should monitor compliance with the update policy.
This can be achieved by generating regular reports that show what versions of applications are in use across the organisation.
Keep it running
Regularly check for updates and set reminders to review application versions; engage staff on the importance of timely updates.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the update policy document: Request to see the formal document that outlines the process for updating applications.
Look at
the schedule and responsibilities defined in the document.
Good evidence
is a comprehensive, clear policy that includes update frequency and roles.
- Check 2 of 5What an auditor asks for
Ask for
a list of current application versions in use: Request a report or inventory showing the versions of important applications like email clients and web browsers.
Look at
versions that are the latest available.
Good evidence
is a detailed list with version numbers matching the most recent releases.
- Check 3 of 5What an auditor asks for
Ask for
update deployment logs: Request logs or records showing when updates were installed on applications.
Look at
recent entries coinciding with the release of new updates.
Good evidence
is logs showing timely updates following new releases.
- Check 4 of 5What an auditor asks for
Ask for
staff communication records: Request copies of any emails, memos, or training materials sent to staff about the importance of keeping applications updated.
Look at
explanations of risks associated with outdated applications.
Good evidence
is clear, targeted communication that reaches all relevant staff.
- Check 5 of 5What an auditor asks for
Ask for
compliance check reports: Request reports that summarise compliance with the updating policy.
Look at
the percentage of applications that are updated versus those that are not.
Good evidence
is a high compliance rate with plans to address any non-compliance.
Mappings
Closest match in ASD Essential Eight: E8-PA-ML1.7, Patch office, browser, email, PDF and security software within two weeks, which partially overlaps with this control.
ASD Essential Eight: 5 mappings
- E8-PA-ML1.7Patch office, browser, email, PDF and security software within two weeksPartially overlaps
This control partially overlaps E8-PA-ML1.7.
E8-PA-ML1.7 requires patches, updates or other vendor mitigations for office productivity suites, web browsers and their extensions, email clients, PDF software and security products to be applied within two weeks of release, while ISM-1467 requires the latest release of the same applications to be used. Both keep these applications current, but E8-PA-ML1.7 sets a patching timeframe and accepts other vendor mitigations, whereas ISM-1467 requires running the latest release rather than any patched version.
This control partially overlaps E8-PA-ML1.9.
ISM-1467 requires organisations to ensure the latest releases of office suites, web browsers and extensions, email clients, PDF applications, and security products are used. E8-PA-ML1.9 directly relates by requiring that those same product categories are removed when vendor support ends, which is a key condition that prevents running non-current/non-patchable versions. ISM-1467 is broader in that it explicitly mandates being on the latest release (even when still supported), while E8-PA-ML1.9 focuses specifically on eliminating unsupported software.
This control partially overlaps E8-PA-ML3.1.
ISM-1467 requires organisations to use the latest releases of key user applications and security products to reduce exposure to known weaknesses. E8-PA-ML3.1 relates by requiring very rapid application of patches/mitigations (within 48 hours) for critical or exploited vulnerabilities in those same product categories. ISM-1467 is about staying current as a standing state, while E8-PA-ML3.1 is an emergency/priority patching requirement that can apply even when an organisation is not upgrading to the latest release.
This control partially overlaps E8-PA-ML3.2.
ISM-1467 requires organisations to use the latest releases of core user applications (office suites, browsers and extensions, email clients, PDF software, and security products). E8-PA-ML3.2 relates by setting a patch/update timeliness requirement (within two weeks) for non-critical vulnerabilities in those same application categories, which is one mechanism to maintain currency. ISM-1467 is version-focused (latest release), whereas E8-PA-ML3.2 is vulnerability/patch-cycle focused and can be met without always being on the absolute latest major release.
This control depends on E8-PA-ML1.4.
ISM-1467 requires organisations to ensure the latest releases of specified user applications and security products are used. E8-PA-ML1.4 supports ISM-1467 by requiring weekly vulnerability scanning to identify missing patches or updates in those same software categories, helping detect where systems have drifted from current versions. E8-PA-ML1.4 is detection/assurance focused, while ISM-1467 is the preventative requirement to actually keep software current.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.