ASD ISM 1698 Daily vulnerability scanning for missing updates
What it says
A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOnline services are checked daily for missing updates to prevent vulnerabilities.
Every day, businesses should check their online services to make sure they have all the latest updates. These updates fix weaknesses that hackers could use to cause harm. If you skip these checks, your business might be left open to cyber attacks that could disrupt operations or steal sensitive information.
Free. Save your status, tasks and notes.
Why it matters
Without daily vulnerability scans for missing updates, online services may remain unpatched and quickly exploited, causing compromise, service disruption and data exposure.
How to implement
Assign the IT team to use a reliable vulnerability scanner every day.
Set up this scanner so it automatically checks for new updates or patches required for all online services. Make sure the team reviews the scanner reports each day to quickly spot and respond to any missing updates.
Have the system owner regularly check the scanner settings.
Ensure that the scanner is configured to examine all existing online services and to notify the IT team of any missing updates. This helps to guarantee that no service is overlooked.
Encourage managers to have regular meetings with the IT team to discuss scanning patterns and results.
During these meetings, verify the frequency and comprehensiveness of scans to ensure no crucial updates are missed.
Allocate responsibility to the system administrator for documenting the scanning process.
They should write clear instructions outlining how the scanner operates and list the platforms it covers, making it easier for others to understand and manage the process.
Encourage managers to train staff regularly on recognising signs of potential vulnerabilities.
This might involve workshops or simple online courses that remind everyone why updates are important and how to keep systems secure.
Keep it running
Run vulnerability scans at least daily across all online services, review findings promptly, and prioritise remediation of missing patches/updates. Track exceptions and rescan after patching.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The daily vulnerability scan reports: Request the automated reports produced by the scanning tool over the past month.
Look at
These reports to check for consistency in scanning and any trends in missing updates.
Good evidence
Report would show daily entries with detected vulnerabilities and clear actions taken.
- Check 2 of 5What an auditor asks for
Look at
Comprehensive coverage across different server and software types. A well-configured file will list all critical systems without gaps.
- Check 3 of 5What an auditor asks for
Look at
Entries showing the update was applied and checked for effectiveness. A detailed log with dates and actions taken would indicate compliance.
- Check 4 of 5What an auditor asks for
Ask for
To see training records related to vulnerability management.
Look at
Records that show regular training sessions for all relevant staff. Check that these sessions include information on recognising and addressing system vulnerabilities. Good training records will have dates, attendee lists, and topics covered.
- Check 5 of 5What an auditor asks for
Ask for
Minutes from meetings where scan results were discussed.
Look at
Regular review cycles and management awareness. Good records will show ongoing commitment to security reviews with noted actions and planned improvements.
Mappings
Closest match in ASD Essential Eight: E8-PA-ML1.3, Daily vulnerability scanning for missing patches in online services, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1698 requires organisations to use a vulnerability scanner at least daily to identify missing patches or updates for vulnerabilities in online services. ISO/IEC 27001:2022 Annex A 8.8 requires obtaining information about technical vulnerabilities, evaluating exposure, and taking appropriate measures, which encompasses broader vulnerability management activities. ISM-1698 is a specific, prescriptive scanning control that fits within Annex A 8.8's wider requirement but does not cover evaluation and treatment in full.
ASD Essential Eight: 6 mappings
This control is equivalent to E8-PA-ML1.3.
E8-PA-ML1.3 requires a vulnerability scanner to be used at least daily to identify missing patches or updates for vulnerabilities in online services. ISM-1698 states the same daily scanning requirement for missing updates in online services. The scope, frequency and objective align closely, so implementing either would largely satisfy the other.
This control is broader than E8-PA-ML1.2.
E8-PA-ML1.2 requires that vulnerability scanning activities use a vulnerability scanner with an up-to-date vulnerability database. ISM-1698 builds on this by mandating at least daily use of a vulnerability scanner to identify missing patches/updates for vulnerabilities in online services, which inherently relies on an up-to-date scanner. ISM-1698 adds prescriptive cadence and a specific scanning objective/scope (missing updates for online services) that E8-PA-ML1.2 does not specify.
This control partially overlaps E8-PO-ML1.3.
E8-PO-ML1.3 requires daily vulnerability scanning to identify missing operating system patches or updates on internet-facing servers and internet-facing network devices. ISM-1698 mandates at least daily scanning to identify missing patches/updates, applied to 'online services', not specifically to OS on internet-facing devices. The controls overlap on daily scanning activity for externally exposed assets, but differ in asset definition and scope.
This control supports E8-PA-ML1.5.
E8-PA-ML1.5 requires organisations to apply critical patches or mitigations for vulnerabilities in online services within 48 hours of release. ISM-1698 supports E8-PA-ML1.5 by requiring daily vulnerability scanning of online services to identify missing patches or updates, helping detect gaps and drive timely remediation. ISM-1698 focuses on detection cadence, while E8-PA-ML1.5 mandates the remediation timeframe for critical issues.
This control supports E8-PA-ML1.6.
E8-PA-ML1.6 requires organisations to apply non-critical patches for vulnerabilities in online services within two weeks where no working exploits exist. ISM-1698 requires daily vulnerability scanning to identify missing patches or updates for vulnerabilities in online services, which provides the detection/visibility needed to reliably meet the two-week patching requirement. Without the capability described in ISM-1698 (or an equivalent mechanism), organisations may not consistently identify missing online-service updates in time to comply with E8-PA-ML1.6.
This control depends on E8-PO-ML1.2.
E8-PO-ML1.2 requires using a vulnerability scanner with an up-to-date vulnerability database for scanning activities. ISM-1698 mandates at least daily scanning to identify missing patches/updates for online services, and achieving reliable daily detection is strengthened by the primary requirement for current vulnerability data. ISM-1698 adds prescriptive frequency and a specific use case (online services) that E8-PO-ML1.2 does not cover.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.