ASD ISM 1483 Use latest release of internet-facing server applications
What it says
The latest release of internet-facing server applications is used.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that internet-facing server applications always use the latest software version.
Always using the latest version of software on servers that face the internet is like having the latest lock for your front door. It keeps out cyber criminals who take advantage of outdated software to break into systems.
Free. Save your status, tasks and notes.
Why it matters
Old software on internet-facing servers can be an entry point for cyber attacks, potentially resulting in data breaches or downtime.
How to implement
IT team should regularly check for updates from software vendors.
They can do this by subscribing to the vendor's notification service and scheduling periodic reviews of available updates.
System administrator should test updates in a controlled environment before deploying them.
This involves setting up a test server that mirrors the production server to ensure updates don't impact other services.
Procurement manager should ensure software maintenance agreements are up-to-date.
Verify contracts include clauses for regular updates and patches as part of the service.
The IT team should schedule monthly maintenance windows for updates.
This ensures that patches can be applied without interrupting regular business operations, keeping servers secure.
Managers should regularly communicate with the IT team to confirm updates are applied.
This can be done through monthly meetings where the progress on updates and any issues are discussed.
Keep it running
Regularly review upcoming vendor updates and coordinate with teams to minimise disruption during patching.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
the server software update log: Request documentation showing recent updates applied to internet-facing servers.
Look at
update dates and version numbers in logs: Check that updates are recent and versions are the latest available.
Good evidence
includes a log with dates less than a month old and version numbers matching the latest vendor release.
- Check 2 of 2What an auditor asks for
Ask for
a list of server applications with descriptions of current versions and vendors: Confirm each application is accounted for.
Look at
consistency with vendor release notes: Verify that listed versions are supported and latest.
Good evidence
includes documentation with each server application listed, version numbers, and cross-referenced with recent vendor release notes.
Mappings
Closest match in ISO/IEC 27001: A.8.8, Management of technical vulnerabilities, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1483 requires internet-facing server applications to be kept on their latest release to address known vulnerabilities. Annex A 8.8 supports this by requiring organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures, which commonly includes upgrading or patching server applications. Annex A 8.8 is broader vulnerability management across systems, while ISM-1483 is a specific prescriptive requirement focused on release currency for internet-facing server applications.
ASD Essential Eight: 4 mappings
This control partially overlaps E8-PA-ML1.5.
ISM-1483 requires internet-facing server applications to use the latest release, reducing risk from vulnerabilities addressed in newer versions. E8-PA-ML1.5 relates by mandating critical patches or vendor mitigations for online services within 48 hours, which is one mechanism to keep exposed services secure. E8-PA-ML1.5 is time-bound patching for critical issues, whereas ISM-1483 is a standing version/release requirement that can include but is not limited to patching.
This control partially overlaps E8-PA-ML1.6.
E8-PA-ML1.6 requires applying non-critical security patches for online services within two weeks when vendors rate them non-critical and no working exploits exist. ISM-1483 supports this outcome by requiring the latest release of internet-facing server applications to be used, which typically includes security fixes and reduces exposure from unpatched vulnerabilities. ISM-1483 focuses on staying current with releases (a currency/standardisation requirement), while E8-PA-ML1.6 is a time-bound patching requirement tied to vendor advisories and exploit status.
This control partially overlaps E8-PA-ML3.3.
ISM-1483 requires that internet-facing server applications are kept on their latest release to reduce exposure to known vulnerabilities. E8-PA-ML3.3 relates by requiring removal of applications that are no longer vendor-supported, which is a key driver for upgrading to current releases. However, E8-PA-ML3.3 applies broadly to many application types and focuses on support status, while ISM-1483 is specifically about internet-facing server applications being on the latest release.
This control partially overlaps E8-PO-ML3.9.
ISM-1483 requires internet-facing server applications to be kept at their latest release. E8-PO-ML3.9 relates by requiring operating systems to be on the latest or previous release, which is the equivalent currency concept but applied to OS rather than server applications. Both reduce risk by avoiding old, vulnerable versions, but they cover different layers (application versus OS) and have different specificity about internet-facing exposure.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.