ASD ISM 1695 Timely application of system security patches
What it says
Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure non-internet-facing systems are updated within a month to protect against known vulnerabilities.
This control means you need to update software on computers and devices that aren't directly connected to the internet within a month of a fix being available. This is important because if you don't, you leave these systems open to attacks from hackers who take advantage of known weaknesses, which can lead to data theft or disruption of business operations.
Free. Save your status, tasks and notes.
Why it matters
Delaying patches on non-internet-facing systems leaves known OS vulnerabilities exploitable, increasing the likelihood of compromise and service disruption.
How to implement
System administrators should keep a list of all non-internet-facing systems that need regular updates.
Use a simple spreadsheet that tracks each system's software updates and when they were last installed.
IT teams should check for available updates or patches from vendors at least once a week.
Go to the vendor's website or use an automatic update checking tool to identify new security patches.
Managers should schedule monthly update sessions with the IT team to ensure all systems are patched.
Use a calendar reminder to confirm these sessions happen and keep notes on what was updated.
Procurement should maintain a list of all current vendors providing software and hardware to the organisation.
This list should include contact information to quickly get update notices or patches when they are released.
IT teams should run a test environment where updates can be installed and verified before applying them to all systems.
Create a simplified version of your network where updates can be tested to ensure they do not disrupt operations.
Keep it running
Track vendor patch releases and apply OS patches to workstations, non-internet-facing servers and network devices within 1 month, after compatibility testing.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
The patch management schedule documentation: Ensure it covers all relevant systems.
Look at
Whether the document includes a monthly update timeline.
Good evidence
Is a clearly defined schedule that aligns with the monthly patch application requirement.
- Check 2 of 3What an auditor asks for
Ask for
Evidence of vendor communication regarding patches.
Look at
Emails or notices about available fixes from vendors. Good evidence will show timely receipt of these updates with noted actions taken.
Good evidence
List is comprehensive and includes every relevant system with corresponding patch status.
- Check 3 of 3What an auditor asks for
Ask for
Testing protocols for patch implementation.
Look at
Documentation that explains how patches are tested before full deployment.
Good evidence
Protocol shows step-by-step testing processes and results to ensure patches are working without issues.
Mappings
Closest match in ASD Essential Eight: E8-PO-ML1.7, One-month operating system patching for workstations, non-internet-facing servers and network devices, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1695 requires organisations to apply OS security patches for non-internet-facing workstations, servers and network devices within one month of release. ISO/IEC 27001:2022 Annex A 8.8 is broader, requiring organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures (which commonly includes patching) across information systems. ISM-1695 is a specific, time-bound patching measure that would sit under an Annex A 8.8 vulnerability management process.
ASD Essential Eight: 3 mappings
- E8-PO-ML1.7One-month operating system patching for workstations, non-internet-facing servers and network devicesEquivalent
This control is equivalent to E8-PO-ML1.7.
E8-PO-ML1.7 and ISM-1695 use identical wording: patches, updates or other vendor mitigations for operating system vulnerabilities on workstations, non-internet-facing servers and non-internet-facing network devices must be applied within one month of release. Meeting either control meets the other.
This control partially overlaps E8-PO-ML3.3.
ISM-1695 mandates applying OS security patches for non-internet-facing workstations, servers and network devices within one month of release. E8-PO-ML3.3 covers the same system types but tightens the requirement to within 48 hours when vulnerabilities are critical or working exploits exist. The two controls overlap on the same patching activity and scope, but they differ materially on timeframes and triggering conditions.
This control partially overlaps E8-PO-ML3.4.
ISM-1695 requires patches, updates or other vendor mitigations for OS vulnerabilities on workstations, non-internet-facing servers and non-internet-facing network devices to be applied within one month of release. E8-PO-ML3.4 aligns to the same asset classes and the same one-month timeframe, but only when the vendor rates the vulnerability as non-critical and no working exploits exist. E8-PO-ML3.4 adds conditionality and severity gating that ISM-1695 does not state, so it is not a full substitute for the primary requirement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.