What does ASD ISM 1695 require?

policyASD Information Security Manual (ISM)

ASD ISM 1695Timely Application of System Security Patches

Official control statement

Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release.

policyASD Information Security Manual (ISM)ISM-1695

Quoted as published. Everything else on this page is written by Control Stack.

In plain English

Ensure non-internet-facing systems are updated within a month to protect against known vulnerabilities.

ML1 ML2 NC OS PASD Information Security ManualGuidelines for system management

Control Stack classificationPreventative Patch management

record_voice_over

What this means in practice

This control means you need to update software on computers and devices that aren't directly connected to the internet within a month of a fix being available. This is important because if you don't, you leave these systems open to attacks from hackers who take advantage of known weaknesses, which can lead to data theft or disruption of business operations.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect (Control Stack)

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

Dec 2023

Control Stack last updated

29 Sept 2026

E8 maturity levels

ML1, ML2

Guideline

Guidelines for system management

Section

System maintenance

Topic

Mitigating known vulnerabilities

priority_high

Why it matters

Delaying patches on non-internet-facing systems leaves known OS vulnerabilities exploitable, increasing the likelihood of compromise and service disruption.

settings

Operational notes

Track vendor patch releases and apply OS patches to workstations, non-internet-facing servers and network devices within 1 month, after compatibility testing.

02 - Implement

build

Implementation tips

System administrators should keep a list of all non-internet-facing systems that need regular updates. Use a simple spreadsheet that tracks each system's software updates and when they were last installed.
IT teams should check for available updates or patches from vendors at least once a week. Go to the vendor's website or use an automatic update checking tool to identify new security patches.
Managers should schedule monthly update sessions with the IT team to ensure all systems are patched. Use a calendar reminder to confirm these sessions happen and keep notes on what was updated.
Procurement should maintain a list of all current vendors providing software and hardware to the organisation. This list should include contact information to quickly get update notices or patches when they are released.
IT teams should run a test environment where updates can be installed and verified before applying them to all systems. Create a simplified version of your network where updates can be tested to ensure they do not disrupt operations.

03 - Audit

fact_check

Audit / evidence tips

AskThe patch management schedule documentation: Ensure it covers all relevant systemsLook atWhether the document includes a monthly update timelineGoodIs a clearly defined schedule that aligns with the monthly patch application requirement
AskEvidence of vendor communication regarding patchesLook atEmails or notices about available fixes from vendors. Good evidence will show timely receipt of these updates with noted actions taken
GoodList is comprehensive and includes every relevant system with corresponding patch status
AskTesting protocols for patch implementationLook atDocumentation that explains how patches are tested before full deploymentGoodProtocol shows step-by-step testing processes and results to ensure patches are working without issues

04 - Mappings

link

Cross-framework mappings

How ISM-1695 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

ISO 27001

Control	Notes	Details
layersPartially meets(1)expand_less
Annex A 8.8	ISM-1695 requires organisations to apply OS security patches for non-internet-facing workstations, servers and network devices within one...

E8

Control	Notes	Details
sync_altPartially overlaps(2)expand_less
E8-PO-ML3.3	ISM-1695 mandates applying OS security patches for non-internet-facing workstations, servers and network devices within one month of release
E8-PO-ML3.4	ISM-1695 requires patches, updates or other vendor mitigations for OS vulnerabilities on workstations, non-internet-facing servers and no...