ASD ISM 1690 Timely application of non-critical vulnerability patches
What it says
Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishApply non-critical patches to online services within two weeks to prevent unexploited vulnerabilities.
This control is about making sure we update our software with non-critical security patches within two weeks after they're available. Even if a vulnerability isn't currently being exploited, leaving it unpatched can give hackers an opportunity to find and use it, which could lead to data breaches or service disruptions.
Free. Save your status, tasks and notes.
Why it matters
Delaying non-critical online-service patches beyond two weeks increases exposure, raising the risk of compromise, data loss, or service disruption.
How to implement
The IT team should monitor software vendor websites or subscribe to their security newsletters.
This helps them stay informed when new patches are released, so they can assess and prepare for timely implementation.
System administrators should schedule regular reviews of available patches.
They can create a simple calendar reminder to check for updates every week, ensuring they catch any recent releases that need action.
Assign a dedicated staff member to manage patches.
This person's role is to verify that the patches are correctly applied within two weeks. They should keep a checklist or a log to track when patches are applied.
The IT team should conduct initial testing of patches in a safe environment.
Set up a test system that mirrors the live environment to ensure patches don't disrupt business operations before they're rolled out widely.
Managers should communicate with staff about the importance of patching.
Send brief updates or reminders about the role patches play in protecting data and systems, which can help you gain organisational support for timely updates.
Keep it running
Track non-critical online-service advisories and confirm no working exploits; apply vendor mitigations within 14 days of release.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The patch management policy document.
Look at
Whether the policy specifies timelines for applying non-critical patches.
Good evidence
Will clearly state that non-critical patches must be applied within two weeks.
- Check 2 of 5What an auditor asks for
Look at
Entries for recent patching activities to confirm they were done within the appropriate timeframe.
Good evidence
Is a log showing consistent updates occurring within two weeks of patch release.
- Check 3 of 5What an auditor asks for
Ask for
Staff training records on patch management.
Look at
The dates and content of training sessions to ensure team members are aware of patch policies.
Good evidence
Will have recent training specifically covering patch timelines.
- Check 4 of 5What an auditor asks for
Look at
The list of vulnerabilities identified and cross-reference with patch logs to verify unpatched vulnerabilities are addressed promptly.
Good evidence
Will show vulnerabilities being resolved within two weeks of patches being available.
- Check 5 of 5What an auditor asks for
Ask for
A demonstration of the testing process for patches.
Look at
How testing ensures patches are safe to apply in the live environment.
Good evidence
Would be a step-by-step process that includes testing, review, and approval steps before full deployment.
Mappings
Closest match in ASD Essential Eight: E8-PA-ML1.6, Apply non-critical patches for online services within two weeks, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1690 requires a specific patching outcome: apply non-critical patches for online services within two weeks when no working exploits exist. ISO/IEC 27001:2022 Annex A 8.8 requires organisations to obtain information about technical vulnerabilities, assess exposure, and take appropriate measures, without prescribing a specific timeframe or limiting to online services. ISM-1690 is therefore a concrete, time-bound implementation that fits within the broader vulnerability management expectations of Annex A 8.8.
ASD Essential Eight: 2 mappings
This control is equivalent to E8-PA-ML1.6.
ISM-1690 requires that patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks when the vendor rates them as non-critical and no working exploits exist. E8-PA-ML1.6 states the same requirement for online services with the same two-week timeframe and the same conditions (non-critical and no working exploits). The scope and triggering conditions align closely, so implementing E8-PA-ML1.6 would largely satisfy ISM-1690.
- E8-PO-ML1.6Timely application of non-critical patches for internet-facing OS vulnerabilitiesPartially overlaps
This control partially overlaps E8-PO-ML1.6.
ISM-1690 requires non-critical vulnerability patches for online services to be applied within two weeks where no working exploits exist. E8-PO-ML1.6 applies a very similar two-week non-critical patching requirement, but specifically for operating systems of internet-facing servers and internet-facing network devices rather than online services broadly. They overlap on timely remediation for internet-exposed components, however ISM-1690 is service-focused while E8-PO-ML1.6 is OS/network-device-focused.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.