ASD ISM 1701 Daily vulnerability scanning for internet-facing systems
What it says
A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUse a daily scanner to find missing security updates on internet-facing systems to keep them secure.
This control is about scanning the systems that are connected to the internet every day to check for any missing security updates. It's crucial because hackers often look for weaknesses in your systems, and without these updates, those weaknesses can be easily exploited. This could lead to data breaches or allow malware to disrupt your business operations.
Free. Save your status, tasks and notes.
Why it matters
Ignoring daily scans on internet-facing systems can leave severe vulnerabilities open for attackers, risking data theft or operational disruption.
How to implement
The IT team should schedule a daily scan for internet-facing systems.
They can use a vulnerability scanning tool that runs automatically each day, checking every connected server and network device for missing updates.
The system owner should review the scan reports daily.
This involves looking at the list of identified vulnerabilities and working with IT to prioritise which updates or patches need to be applied urgently.
The IT manager should ensure the scanning tool is properly configured and updated.
This means setting the tool to cover all relevant systems and network devices and checking that it's up to date with the latest threat definitions.
The IT team should document any actions taken after each scan.
Record which vulnerabilities were found and the steps taken to address them, ensuring transparency and accountability.
The office manager should have a brief weekly check-in with the IT team to understand any persistent issues.
This involves discussing any patterns of recurring vulnerabilities and what is being done to mitigate them.
Keep it running
Run vulnerability scans at least daily on all internet-facing servers and network devices; review findings and prioritise patching or mitigation of critical OS issues.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The daily scan logs or reports: Request records of the scans performed on internet-facing systems.
Look at
The date and time to ensure they are run daily.
Good evidence
Includes logs showing daily activity with consistent timestamps.
- Check 2 of 5What an auditor asks for
Ask for
To see the update or patching records: Request documentation showing which updates were applied following scan discoveries.
Look at
Specific details such as update names and dates applied.
Good evidence
Would be recent records matching the vulnerabilities identified in the scan reports.
- Check 3 of 5What an auditor asks for
Ask for
Evidence of the scanning tool's version and configuration: Request documentation or a demonstration showing the tool's configuration.
Look at
Evidence that the tool covers all internet-facing systems and is updated.
Good evidence
Is a recent configuration file or screenshot showing current system coverage.
- Check 4 of 5What an auditor asks for
Ask for
About the follow-up process for vulnerabilities: Request documentation or an explanation of the process after scanning.
Look at
Who is responsible for actioning identified vulnerabilities and the timeframe for doing so.
Good evidence
Is a clear process document with assigned responsibilities and timelines.
- Check 5 of 5What an auditor asks for
Ask for
To review meeting notes from check-ins with management: Request notes or summaries from any meetings where scan results are discussed.
Look at
Mention of actions taken or planned to address vulnerabilities.
Good evidence
Includes notes with detailed action points and outcomes.
Mappings
Closest match in ASD Essential Eight: E8-PO-ML1.3, Use a daily vulnerability scanner for internet-facing systems, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1701 requires a specific operational practice: daily vulnerability scanning to find missing OS patches on internet-facing servers and internet-facing network devices. ISO/IEC 27001:2022 Annex A 8.8 requires organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures across information systems in use. ISM-1701 is a concrete, scoped implementation approach that fits within the broader vulnerability management expectation of Annex A 8.8.
ASD Essential Eight: 5 mappings
This control is equivalent to E8-PO-ML1.3.
ISM-1701 requires a vulnerability scanner be used at least daily to identify missing operating system patches or updates on internet-facing servers and internet-facing network devices. E8-PO-ML1.3 states the same scanning frequency, scope (internet-facing servers/devices) and purpose (identify missing OS patches/updates). Implementing E8-PO-ML1.3 would substantially satisfy ISM-1701 and vice versa.
This control is broader than E8-PA-ML1.2.
E8-PA-ML1.2 requires vulnerability scanning activities to be performed with a scanner that has an up-to-date vulnerability database. ISM-1701 mandates at least daily scanning to identify missing patches/updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices, which depends on current vulnerability content to be meaningful. ISM-1701 adds explicit frequency and a specific internet-facing infrastructure scope that E8-PA-ML1.2 does not specify.
This control partially overlaps E8-PA-ML1.3.
E8-PA-ML1.3 requires daily vulnerability scanning to identify missing patches or updates for vulnerabilities in online services. ISM-1701 also mandates at least daily scanning, but focuses specifically on missing patches in operating systems of internet-facing servers and internet-facing network devices rather than the broader online service stack. They overlap on daily scanning for internet-exposed components, but each has a different primary scope (service-layer vs OS/device-layer).
This control supports E8-PO-ML1.5.
ISM-1701 requires daily vulnerability scanning of internet-facing servers and network devices to identify missing OS patches or updates. E8-PO-ML1.5 requires applying critical OS patches for those same internet-facing assets within 48 hours, which is an action taken after vulnerabilities/patch gaps are identified. ISM-1701 supports E8-PO-ML1.5 by providing the detection mechanism that informs and prioritises urgent patching, but it does not itself mandate remediation timeframes.
This control depends on E8-PO-ML1.2.
E8-PO-ML1.2 requires use of a vulnerability scanner with an up-to-date vulnerability database for scanning activities. ISM-1701 mandates at least daily scanning for missing patches/updates on internet-facing servers and network devices. Current vulnerability data is necessary to detect newly disclosed issues on exposed systems. ISM-1701 is more prescriptive about frequency and targets, whereas E8-PO-ML1.2 is a foundational tool-quality requirement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.