ASD ISM 1700 Regular vulnerability scanning for applications
What it says
A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishA scanner is used every two weeks to find missing updates in most applications.
This control means using a tool every two weeks to check if your software is missing any updates, except for office apps and browsers. It's important because outdated software can have security gaps, making it easier for hackers to break in and cause damage to your business or steal information.
Free. Save your status, tasks and notes.
Why it matters
Without at least fortnightly vulnerability scans for non-standard applications, missing patches can go unnoticed, enabling exploitation and potential data breaches.
How to implement
The IT team should schedule and perform a vulnerability scan every two weeks.
They can do this by using a recognised scanning tool to automatically check for any missing updates in the software applications. Make sure the tool is set up properly to exclude office apps and browsers as per the control instructions.
System owners should review the scan results with the IT team.
After each scan, sit down and go over the list of missing updates together. Prioritise which updates need immediate attention based on the risk they pose to your business.
Managers should ensure the IT budget includes funds for a reliable vulnerability scanning tool.
Coordinate with procurement to research and obtain a tool that suits your organisation's needs and complies with the requirements of scanning every two weeks.
IT staff should be trained to operate the vulnerability scanning tool effectively.
Arrange for training sessions or workshops to ensure everyone knows how to use the tool correctly and interpret the scan results.
The IT team should document the scanning process and outcomes.
After each session, record what was scanned, what vulnerabilities were found, and what actions were taken. This documentation will help in audits and tracking progress over time.
Keep it running
Schedule automated scans at least every two weeks for non-standard applications, and triage results quickly to patch missing updates and close known vulnerabilities.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The vulnerability scan schedule: Verify that there is a consistent, documented schedule for fortnightly scans.
Look at
The dates and frequency of past scans to ensure adherence.
Good evidence
Is a regular, uninterrupted schedule of scans logged at least every two weeks.
- Check 2 of 5What an auditor asks for
Ask for
Scan result reports: Request recent reports generated by the vulnerability scanning tool.
Look at
The specifics like what applications were scanned and what vulnerabilities were found.
Good evidence
Includes a detailed, easy-to-understand report outlining findings and prioritisation of risks.
- Check 3 of 5What an auditor asks for
Ask for
The remediation action plan: Request documents showing how identified vulnerabilities have been addressed.
Look at
A clear action plan with timelines and responsible parties.
Good evidence
Includes timely corrections for high-risk vulnerabilities.
- Check 4 of 5What an auditor asks for
Ask for
Training records: Inquire about evidence showing IT staff have been trained to use the scanning tool.
Look at
Attendance lists or certifications.
Good evidence
Includes current training completion records for all IT personnel operating the tool.
- Check 5 of 5What an auditor asks for
Ask for
IT budget documentation: Check if the scanning tool and process have been budgeted for.
Look at
Expense reports and procurement justifications.
Good evidence
Includes consistent funding allocated to maintain vulnerability scanning capabilities.
Mappings
Closest match in ASD Essential Eight: E8-PA-ML2.1, Fortnightly vulnerability scanning for non-core applications, which asks for the same thing.
ASD Essential Eight: 5 mappings
This control is equivalent to E8-PA-ML2.1.
E8-PA-ML2.1 requires a vulnerability scanner be used at least fortnightly to identify missing patches or updates for vulnerabilities in non-core applications (excluding office suites, browsers/extensions, email clients, PDF software, and security products). ISM-1700 states the same scanning frequency and the same application scope exclusions to find missing patches/updates. The intent, cadence, and target application set align closely, so implementing ISM-1700 would largely satisfy E8-PA-ML2.1.
This control is broader than E8-PA-ML1.2.
E8-PA-ML1.2 requires that vulnerability scanning uses a scanner with an up-to-date vulnerability database. ISM-1700 requires at least fortnightly scanning to identify missing patches/updates in a defined set of applications, which inherently relies on an up-to-date scanner database for accuracy. ISM-1700 is more prescriptive about scanning cadence and target asset class, whereas E8-PA-ML1.2 focuses on the currency of the scanner's vulnerability data.
This control partially overlaps E8-PA-ML1.4.
E8-PA-ML1.4 requires organisations to use a vulnerability scanner at least weekly to identify missing patches or updates in key end-user software like office suites, browsers/extensions, email clients, PDF software, and security products. ISM-1700 similarly mandates regular vulnerability scanning to find missing patches/updates but applies to applications other than those listed in E8-PA-ML1.4 and sets a fortnightly minimum. They overlap on the method (vulnerability scanning for missing patches) but differ in target software scope and scanning frequency.
This control supports E8-PA-ML2.2.
E8-PA-ML2.2 requires organisations to apply vendor patches/mitigations for vulnerabilities in non-critical applications within one month. ISM-1700 supports E8-PA-ML2.2 by requiring fortnightly vulnerability scanning to identify missing patches/updates for the same application category. ISM-1700 focuses on detection and verification, while E8-PA-ML2.2 focuses on the remediation timeframe.
This control depends on E8-PO-ML1.1.
ISM-1700 requires fortnightly vulnerability scanning to identify missing patches/updates for non-core applications. E8-PO-ML1.1 requires automated asset discovery at least fortnightly to identify assets for subsequent vulnerability scanning. ISM-1700 depends on accurate, up-to-date asset discovery to ensure scanning coverage is complete and the 'missing patches' results are meaningful across the environment.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.