ASD ISM 1699 Weekly vulnerability scanning for software updates
What it says
A vulnerability scanner is used at least weekly to identify missing patches or updates for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEvery week, a scanner checks for software updates to fix security issues in commonly used applications.
Every week, a system checks our software to see if there are any updates we need to install. This process is important because missing updates can leave our computers open to attacks, potentially exposing private information and harming our operations.
Free. Save your status, tasks and notes.
Why it matters
Without weekly vulnerability scanning, missing patches in browsers, email clients, PDF apps and security tools can be exploited, causing breaches and outages.
How to implement
IT team: Schedule a weekly task to run a vulnerability scanner across all office software.
Use tools that automatically check for updates in common applications like the web browser and office software. Ensure the scanner is set to run on a specific day each week to maintain consistency.
System administrator: Make a list of all the software used within the organisation that needs regular updates.
Include software such as web browsers, email apps, and PDF readers. Use this list to configure the vulnerability scanner to check these specific applications.
Office manager: Coordinate with the IT team to educate staff on the importance of keeping systems updated.
Explain how regular updates protect sensitive information and keep the business running smoothly. Use simple examples to illustrate how a lack of updates could lead to data breaches.
IT support: Review the scanner's reports weekly to identify any missing updates.
Prioritise applying critical patches or updates that address high-risk vulnerabilities. Ensure that any detected vulnerabilities are promptly assessed and resolved.
System owner: Monitor the overall process to make sure scans are completed and updates are applied.
Set up a regular review process to ensure the scanning procedure is effective and adapts to any changes in software usage or threats.
Keep it running
Run the scanner at least weekly across endpoints; review reports, prioritise missing patches for browsers, office suites and security products, and track remediation to closure.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A log of weekly vulnerability scans conducted: Request documentation showing when and how often scans were carried out.
Look at
Regular entries that are consistently timestamped.
Good evidence
Includes a complete record of weekly checks over the past three months.
- Check 2 of 5What an auditor asks for
Ask for
A list of software covered by the scanner: Request a documented list that includes all major applications used in the office.
Look at
Whether the list is comprehensive and regularly updated.
Good evidence
Features all office productivity and security software with dates of last updates.
- Check 3 of 5What an auditor asks for
Ask for
The update implementation report: Request reports or logs that indicate when identified updates were applied.
Look at
The timelines and promptness of applying these updates.
Good evidence
Will show updates applied within a reasonable period after detection.
- Check 4 of 5What an auditor asks for
Ask for
Meeting notes between the IT team and office manager: Request documentation from discussions about update processes and education of staff.
Look at
Clear communication and scheduled educational sessions.
Good evidence
Includes meeting minutes and educational material made for staff.
- Check 5 of 5What an auditor asks for
Ask for
A policy document on software updating: Request the organisation's written policy on keeping software up-to-date.
Look at
Clear guidelines and procedures outlined for using vulnerability scanners.
Good evidence
Includes a policy that is current and thoroughly outlines responsibilities and processes.
Mappings
Closest match in ASD Essential Eight: E8-PA-ML1.4, Weekly scanning for missing patches or updates in key software, which asks for the same thing.
ASD Essential Eight: 6 mappings
This control is equivalent to E8-PA-ML1.4.
E8-PA-ML1.4 requires a vulnerability scanner be used at least weekly to identify missing patches or updates for office productivity suites, web browsers and extensions, email clients, PDF applications, and security products. ISM-1699 states the same minimum frequency, the same scanning approach, and the same software scope. Implementing E8-PA-ML1.4 would largely satisfy ISM-1699 and vice versa.
This control is broader than E8-PA-ML1.2.
E8-PA-ML1.2 requires use of a vulnerability scanner with an up-to-date vulnerability database for scanning activities. ISM-1699 mandates at least weekly scanning to identify missing patches/updates for specific high-risk software categories (office productivity suites, browsers, email clients, PDF applications, security products), which relies on an up-to-date vulnerability database. ISM-1699 adds defined frequency and software scope that E8-PA-ML1.2 does not include.
This control is broader than E8-PO-ML1.2.
E8-PO-ML1.2 requires that vulnerability scanning activities use a vulnerability scanner with an up-to-date vulnerability database. ISM-1699 expands this into a specific practice by requiring at least weekly scanning for missing patches/updates across common applications (browsers, office suites, email clients, PDF apps, security products), where current scanner signatures are necessary to detect known issues. ISM-1699 is broader due to its prescribed frequency and defined software scope, while E8-PO-ML1.2 addresses only the updated-database requirement.
This control partially overlaps E8-PA-ML2.1.
ISM-1699 requires weekly vulnerability scanning to identify missing patches/updates for a defined set of key end-user software (productivity, browsers, email, PDF, security products). E8-PA-ML2.1 also requires vulnerability scanning for missing patches/updates, but it targets applications outside that key software set and only requires it at least fortnightly. They overlap on the practice of scanning for missing patches, but differ on software scope (core vs non-core applications) and required frequency (weekly vs fortnightly).
This control supports E8-PA-ML1.7.
ISM-1699 requires a vulnerability scanner to be used at least weekly to find missing patches or updates in office productivity suites, web browsers and their extensions, email clients, PDF applications and security products, and E8-PA-ML1.7 requires those patches to be applied within two weeks of release. The weekly scanning in ISM-1699 identifies the missing patches that E8-PA-ML1.7 needs applied and shows whether any remain outstanding.
This control supports E8-PA-ML3.1.
E8-PA-ML3.1 requires organisations to deploy vendor mitigations within 48 hours for critical or exploited vulnerabilities in specified application categories and security products. ISM-1699 requires weekly vulnerability scanning to identify missing patches for those same application categories, which supports timely detection, verification, and reporting of whether the 48-hour patching target is being met. ISM-1699 strengthens assurance and prioritisation for E8-PA-ML3.1 but does not itself mandate the 48-hour remediation action.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.