ASD ISM 1694 Timely application of non-critical security patches
What it says
Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishApply patches for non-critical vulnerabilities on internet-facing devices within two weeks if no known exploits are available.
This control means that if there's a known weakness in the software of your devices that connect to the internet, you need to fix it within two weeks if it isn't a major issue and no one is trying to exploit it yet. This matters because even smaller weaknesses can become big problems if left unaddressed, potentially allowing cybercriminals to access your systems and compromise your data.
Free. Save your status, tasks and notes.
Why it matters
Delaying non-critical patching on internet-facing systems increases exposure to compromise, enabling unauthorised access and data breaches.
How to implement
The IT team should regularly check for new updates or patches for internet-facing devices.
Use subscription services from software vendors to get notified whenever a new patch or update is released.
System owners should prioritise applying these patches within two weeks of their release.
Establish a clear process for evaluating the criticality of updates and make a schedule to apply non-critical ones promptly.
Managers should ensure resources are available for the IT team to perform these updates.
This means allowing time and providing the necessary tools like access to systems and software to make updates possible.
IT staff should test patches in a controlled environment before deploying them broadly.
Set up a small test system that mimics the main system to apply patches first and ensure they don't disrupt operations.
Communication should come from the IT team to all users impacted by potential updates.
Inform staff about scheduled updates and any potential downtime so they can plan their work accordingly.
Keep it running
Track vendor releases; when rated non-critical and no working exploit exists, patch internet-facing servers/devices within 14 days.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
The patch management policy document: Check this document to see if it includes procedures for handling non-critical patches within two weeks. Good contains timeframes, roles responsible, and steps to handle patches.
Look at
The last few reports to check that patches have been applied within the prescribed period. Good shows dates of patch releases and application within two weeks.
- Check 2 of 3What an auditor asks for
Ask for
A list of known non-critical vulnerabilities and corresponding action logs: Inspect the action logs to verify that non-critical patches were indeed applied. Good has vulnerability details, patch release dates, and times of application.
- Check 3 of 3What an auditor asks for
Ask for
Records of test environments used for patches: Verify that the team uses these environments to test patches before widespread application. Good shows a separate environment setup that allows pre-deployment testing.
Mappings
Closest match in ASD Essential Eight: E8-PO-ML1.6, Timely application of non-critical patches for internet-facing OS vulnerabilities, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1694 requires a specific patching outcome: non-critical OS vulnerabilities on internet-facing servers and network devices are remediated within two weeks when no working exploits exist. ISO/IEC 27001:2022 Annex A 8.8 requires organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures, which broadly includes patching and other treatments. ISM-1694 is a prescriptive, time-bound implementation that fits within the broader vulnerability management expectations of Annex A 8.8.
ASD Essential Eight: 5 mappings
- E8-PO-ML1.6Timely application of non-critical patches for internet-facing OS vulnerabilitiesEquivalent
This control is equivalent to E8-PO-ML1.6.
E8-PO-ML1.6 requires applying non-critical patches (where no working exploits exist) to operating systems on internet-facing servers and internet-facing network devices within two weeks of vendor release. ISM-1694 states the same patching requirement with the same scope (internet-facing OS on servers and network devices), the same condition (non-critical, no working exploits), and the same timeframe (two weeks). Implementing either control would largely satisfy the other.
This control partially overlaps E8-PA-ML1.6.
ISM-1694 requires non-critical operating system security patches for internet-facing servers and internet-facing network devices to be applied within two weeks of release when no working exploits exist. E8-PA-ML1.6 is similar in timing and conditions, but it applies to online services rather than operating systems. They overlap on the concept of timely remediation for internet-exposed attack surfaces, but differ materially in the asset class being patched (OS vs online services).
This control partially overlaps E8-PO-ML1.5.
ISM-1694 requires applying vendor mitigations for non-critical vulnerabilities in operating systems on internet-facing servers and network devices within two weeks when no working exploits exist. E8-PO-ML1.5 covers the same platforms (internet-facing OS on servers and network devices), but for a different trigger and timeframe: critical vulnerabilities or working exploits within 48 hours. They overlap on patching internet-facing operating systems, but address different severity/exploit conditions and response timelines.
This control partially overlaps E8-PO-ML3.4.
E8-PO-ML3.4 requires applying non-critical OS patches within one month for non-internet-facing workstations, servers and network devices when no working exploits exist. ISM-1694 addresses the same non-critical/no-exploit condition but for internet-facing servers and internet-facing network devices, and mandates a two-week timeframe. The controls overlap on the concept of severity- and exploit-aware OS patching, but differ materially in exposure scope (internal vs internet-facing) and required timeliness.
This control depends on E8-PO-ML1.3.
ISM-1694 requires non-critical operating system patches on internet-facing servers and network devices to be applied within two weeks under specified exploit conditions. E8-PO-ML1.3 supports this by requiring daily vulnerability scanning to identify missing patches for those same internet-facing operating systems, improving the organisation's ability to detect and action required patching. Scanning is not the same as patch deployment, but it directly strengthens the assurance that ISM-1694 patching deadlines are met.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.