ASD ISM 1691 Timely vulnerability patching in software tools
What it says
Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishApply patches to major software tools like browsers and email clients within two weeks to prevent vulnerabilities.
This control is about making sure that updates for important software like web browsers and email programs are applied within two weeks of their release. This is crucial because failing to update these tools can leave your business open to cyber attacks, where hackers exploit these vulnerabilities to steal data or disrupt operations.
Free. Save your status, tasks and notes.
Why it matters
Unchecked vulnerabilities in browsers, email clients, PDF apps and security tools can be exploited quickly, leading to compromise, data loss, and outages.
How to implement
The IT team should keep a list of all key software tools in use, such as browsers, email clients, and office productivity software.
They should check weekly for new updates or patches released by the software vendors, using vendor websites or automated notification systems.
System administrators should set up automatic updates wherever possible in the software settings.
If automatic updates are not available, they should plan for manual installation within the outlined two-week period to ensure compliance.
Managers should ensure that team members are aware of the importance of timely updates and offer guidelines on how to report issues if automatic updates fail.
This includes providing contact information for IT support within the organisation.
Procurement officers should evaluate and choose software vendors that have a clear track record of timely updates and provide support for patching vulnerabilities quickly.
This can be assessed during the initial acquisition of the software.
Office managers should facilitate regular meetings between IT staff and department heads to discuss the current status of software updates.
This ensures all departments are on track and any hurdles can be addressed promptly.
Keep it running
Track vendor releases for listed apps and enforce patching within 14 days; use automation for rollout, but validate and expedite critical/high-risk fixes.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The software inventory list: Request a list of all major software tools in use, including browsers and email clients.
Look at
The completeness and currency of the inventory.
Good evidence
Is a well-maintained, up-to-date list that is regularly reviewed and modified as needed.
- Check 2 of 5What an auditor asks for
Ask for
Update logs or records: Request documentation showing the dates when patches were applied to the listed software.
Look at
The time elapsed between patch release and application.
Good evidence
Is consistently applying patches within two weeks, with explanations for any delays.
- Check 3 of 5What an auditor asks for
Ask for
Automatic update settings documentation: Request screenshots or configuration logs showing the settings for automatic updates. Look to confirm that automatic updates are enabled where possible.
Good evidence
Demonstrates proactive configuration of settings for consistent patch deployment.
- Check 4 of 5What an auditor asks for
Ask for
Meeting notes or agendas: Request records of recent IT and department meetings that discuss software updates.
Look at
Topics related to patch status and any blocking issues.
Good evidence
Shows regular discussion and swift action on update issues.
- Check 5 of 5What an auditor asks for
Ask for
Vendor contracts or agreements: Request procurement documents that show the criteria for selecting software vendors, especially concerning update and patch support.
Look at
Clauses or criteria related to timely security updates.
Good evidence
Would include a detailed vendor assessment regarding patch reliability and support.
Mappings
Closest match in ASD Essential Eight: E8-PA-ML1.7, Patch office, browser, email, PDF and security software within two weeks, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1691 sets a specific, time-bound requirement to apply vendor patches/mitigations for vulnerabilities in common productivity and security software within two weeks. ISO/IEC 27001:2022 Annex A 8.8 is broader, requiring organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures across information systems generally. ISM-1691 is one concrete implementation of Annex A 8.8 focused on a defined software set and a defined remediation timeframe.
ASD Essential Eight: 4 mappings
This control is equivalent to E8-PA-ML1.7.
E8-PA-ML1.7 and ISM-1691 both require patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software and security products to be applied within two weeks of release. They are the same requirement, with the ISM saying 'PDF applications' where the Essential Eight says 'PDF software'.
This control partially overlaps E8-PA-ML3.1.
ISM-1691 mandates applying patches for key end-user software (e.g. browsers, email clients, PDF apps, security products) within two weeks of release. E8-PA-ML3.1 covers the same software categories but tightens the requirement to patch within 48 hours when vulnerabilities are critical or working exploits exist. The overlap is the shared software scope and patching intent, while the candidate introduces a stricter, risk-triggered SLA not expressed in ISM-1691.
This control partially overlaps E8-PA-ML3.2.
ISM-1691 requires patches, updates or vendor mitigations for vulnerabilities in office productivity suites, web browsers and extensions, email clients, PDF applications, and security products to be applied within two weeks of release. E8-PA-ML3.2 aligns to this same software scope and two-week timeframe, but only when vendors assess vulnerabilities as non-critical and no working exploits exist. ISM-1691 does not include the candidate's conditionality around severity/exploitability, making the requirements only partially aligned rather than identical.
This control depends on E8-PA-ML1.4.
E8-PA-ML1.4 requires weekly scanning to identify missing patches or updates in key software so remediation can be actioned. ISM-1691 requires those patches/updates/mitigations for the same software categories to be applied within two weeks of release. Weekly scanning under E8-PA-ML1.4 supports ISM-1691 by providing the detection and visibility needed to meet the two-week patch application timeframe, but scanning alone does not ensure patching occurs.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.