ASD ISM 1692 Quick apply critical patches for vulnerabilities
What it says
Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishApply crucial software patches within 48 hours to prevent security breaches from known vulnerabilities.
Applying critical software updates within 48 hours ensures your systems are protected from security gaps that malicious hackers might exploit. If these updates aren't applied quickly, your organisation could be exposed to cyber attacks that can steal sensitive information or disrupt operations.
Free. Save your status, tasks and notes.
Why it matters
Not applying critical vendor patches within 48 hours for browsers, email, PDF and security tools increases likelihood of exploitation, data compromise and operational disruption.
How to implement
IT team should monitor for software patch releases: Keep an eye on updates from software vendors related to office software, web browsers, and security tools.
Set up alerts or regularly check the vendors' websites for any new updates that are flagged as critical.
IT manager should establish a patch application process: Decide who will apply the patches, which systems need them, and how to verify the updates are successful.
Create a checklist to make sure no step is missed during this patching process.
System administrator should perform the patching task: Once critical patches are identified, ensure they are loaded onto all relevant systems within 48 hours.
Follow the instructions provided by the software vendor to apply the updates correctly.
Office manager should schedule regular check-ins with IT: Organise weekly meetings to review what patches have been released and confirm that critical updates were applied on time.
Document these discussions to keep track of compliance.
HR or admin head should educate staff about the importance: Inform employees why these updates are crucial and encourage them to alert IT if they notice any update prompts on their work machines.
Regular staff meetings can include a brief reminder about this process.
Keep it running
Track vendor advisories and exploit intel for browsers, office, email, PDF and security products; prioritise automated rollout and verification to meet the 48‑hour critical patch SLA.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The update log from IT systems: Request the documented record of all patches applied in the past few months.
Look at
The dates patches were released and when they were applied.
Good evidence
All critical patches applied within 48 hours of release.
- Check 2 of 5What an auditor asks for
Good evidence
Alerts are in place and show actionable updates with time frames.
- Check 3 of 5What an auditor asks for
Ask for
The checklist used during patch application: Request the documented process checklist for implementing patches.
Look at
Step-by-step instructions followed during each update cycle.
Good evidence
A detailed checklist that aligns with applied patches.
- Check 4 of 5What an auditor asks for
Ask for
Minutes or notes from the meetings between office and IT staff.
Look at
Discussions regarding pending or applied patches.
Good evidence
Regular meeting notes reflecting awareness and action on patches.
- Check 5 of 5What an auditor asks for
Look at
Clarity and frequency in communication.
Good evidence
Emails sent promptly after critical update releases with clear action instructions.
Mappings
Closest match in ASD Essential Eight: E8-PA-ML3.1, Patch critical vulnerabilities in applications within 48 hours, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1692 requires a specific, time-bound response: applying critical patches for defined application categories within 48 hours when vendor-rated critical or exploited. ISO/IEC 27001:2022 Annex A 8.8 requires organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures, which includes patching but is not limited to it. ISM-1692 is therefore a prescriptive subset implementation of the broader vulnerability management requirement in Annex A 8.8.
ASD Essential Eight: 4 mappings
This control is equivalent to E8-PA-ML3.1.
E8-PA-ML3.1 requires patches, updates or vendor mitigations for critical or exploited vulnerabilities in office suites, browsers/extensions, email clients, PDF software, and security products to be applied within 48 hours of release. ISM-1692 states the same software scope, the same criticality/exploitation triggers, and the same 48-hour timeframe. Implementing ISM-1692 would largely satisfy E8-PA-ML3.1 as written.
- E8-PA-ML1.7Patch office, browser, email, PDF and security software within two weeksPartially overlaps
This control partially overlaps E8-PA-ML1.7.
E8-PA-ML1.7 requires patches for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software and security products to be applied within two weeks of release, while ISM-1692 requires patches for the same applications within 48 hours when vulnerabilities are assessed as critical or working exploits exist. ISM-1692 is stricter for critical or exploited vulnerabilities, and E8-PA-ML1.7 also covers non-critical vulnerabilities that ISM-1692 does not, so they overlap.
This control partially overlaps E8-PA-ML3.2.
E8-PA-ML3.2 requires organisations to apply patches for non-critical vulnerabilities in common user applications and security products within two weeks where no working exploits exist. ISM-1692 covers the same application/product classes but for critical vulnerabilities or working exploits, within 48 hours. They align on patch-management objectives but differ in risk conditions and urgency.
This control depends on E8-PA-ML1.4.
E8-PA-ML1.4 requires weekly scanning to identify missing patches or updates for vulnerabilities in key user applications and security products. ISM-1692 requires those patches/updates to be applied within 48 hours when vendors rate vulnerabilities as critical or when working exploits exist. E8-PA-ML1.4 supports ISM-1692 by providing a detection mechanism to quickly identify which assets are missing urgent patches, although it does not impose the 48-hour remediation timeframe.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.