ASD ISM 1702 Regularly scan for missing security patches
What it says
A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRegular checks detect missing updates on devices to fix security gaps.
Think of your computer systems like a car that needs regular servicing. If you don't check for and fix missing updates, security holes might let in online attackers, much like leaving your car doors unlocked in a busy parking lot. Regular scanning can prevent these potential threats from becoming real problems.
Free. Save your status, tasks and notes.
Why it matters
Unpatched internal workstations, servers and network devices can be exploited, causing data compromise, lateral movement and service outages.
How to implement
The IT team should set up a schedule for regular checks: Use a calendar reminder or software to perform scans every fortnight.
This way, they'll identify any missing updates or patches in the system before issues arise.
Office managers should maintain a checklist of systems: Keep an inventory of all devices that need to be scanned, such as computers and servers.
This helps ensure nothing is missed during regular security checks.
The IT team should review scan results promptly: After each scan, go through the results to find out which patches are missing.
If any critical patches are found missing, plan to install these updates as soon as possible.
Business leaders should ensure proper resources are allocated: Make sure the IT team has the staff, tools, and time to conduct these scans effectively.
Having the right support ensures the job gets done consistently and well.
Keep it running
Run vulnerability scans at least fortnightly across internal workstations, servers and network devices; prioritise missing OS patches and track remediation to closure.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The scanning schedule: Request documentation that shows the regular scanning timetable.
Look at
Evidence that scans are conducted at least every fortnight.
Good evidence
Would be a consistently updated and followed schedule.
- Check 2 of 5What an auditor asks for
Ask for
The list of checked systems: Ensure there is a comprehensive inventory of workstations, servers, and network devices included in the scans.
Look at
How complete and up-to-date the list is.
Good evidence
Has all current devices listed with no serious omissions.
- Check 3 of 5What an auditor asks for
Ask for
Recent scan reports: Obtain the last two or three vulnerability scan reports for review.
Look at
The details of what patches were missing and what actions were taken.
Good evidence
Shows prompt acknowledgment and rectification of any vulnerabilities.
- Check 4 of 5What an auditor asks for
Ask for
Evidence of update installations: Request records or logs that show updates have been applied after being identified.
Look at
Dated confirmations that patches were indeed installed.
Good evidence
Includes dates and details correlating to the scan findings.
- Check 5 of 5What an auditor asks for
Ask for
About the tools used for scanning: Find out which software or methods are used to carry out the scans.
Look at
Reputable and regularly updated tools being used.
Good evidence
Names recognised tools with proof of their current effectiveness.
Mappings
Closest match in ASD Essential Eight: E8-PO-ML1.4, Use a vulnerability scanner fortnightly to find missing OS patches, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1702 requires a specific operational practice: running a vulnerability scanner at least fortnightly to identify missing operating system patches on non-internet-facing endpoints, servers, and network devices. Annex A 8.8 requires organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures, covering the full vulnerability management lifecycle. ISM-1702 is a narrower, prescriptive detection activity that fits within the broader ISO requirement but does not cover evaluation and treatment comprehensively.
ASD Essential Eight: 7 mappings
This control is equivalent to E8-PO-ML1.4.
ISM-1702 requires a vulnerability scanner to be used at least fortnightly to identify missing patches/updates for operating systems on workstations, non-internet-facing servers, and non-internet-facing network devices. E8-PO-ML1.4 states the same scanning cadence and the same scope of assets and OS patch identification. Implementing E8-PO-ML1.4 would largely satisfy ISM-1702 with no material differences in intent or coverage.
This control partially overlaps E8-PO-ML1.3.
ISM-1702 requires fortnightly vulnerability scanning to identify missing operating system patches on non-internet-facing workstations, servers, and network devices. E8-PO-ML1.3 also requires vulnerability scanning for missing OS patches, but it targets internet-facing servers and internet-facing network devices and sets a higher cadence (at least daily). The controls align on the scanning purpose (finding missing OS patches) but differ materially in asset exposure and required frequency.
- E8-PO-ML1.7One-month operating system patching for workstations, non-internet-facing servers and network devicesSupports
This control supports E8-PO-ML1.7.
ISM-1702 requires a vulnerability scanner to be used at least fortnightly to find missing operating system patches on workstations, non-internet-facing servers and non-internet-facing network devices, and E8-PO-ML1.7 requires those patches to be applied within one month of release. The scanning identifies the gaps on exactly the same systems that E8-PO-ML1.7 then requires to be closed, so reliable timely patching depends on it.
This control supports E8-PO-ML3.3.
ISM-1702 requires organisations to run a vulnerability scanner fortnightly to identify missing operating system patches on non-internet-facing assets. E8-PO-ML3.3 focuses on remediation by requiring critical OS patches (or mitigations) for those same non-internet-facing assets to be applied within 48 hours. ISM-1702 supports E8-PO-ML3.3 by providing the detection mechanism that helps identify patching gaps, but it does not set any patch deployment timeframes.
This control supports E8-PO-ML3.4.
ISM-1702 requires fortnightly scanning to identify missing operating system patches on workstations, non-internet-facing servers, and non-internet-facing network devices. E8-PO-ML3.4 requires non-critical OS patches for those same non-internet-facing assets to be applied within one month when no working exploits exist. ISM-1702 supports E8-PO-ML3.4 by enabling identification of missing patches, but it does not define prioritisation rules or patch application deadlines.
This control depends on E8-PA-ML1.1.
E8-PA-ML1.1 requires automated asset discovery at least fortnightly so organisations can detect what assets exist for follow-on vulnerability scanning. ISM-1702 requires using a vulnerability scanner at least fortnightly for workstations, non-internet-facing servers and non-internet-facing network devices to identify missing patches. E8-PA-ML1.1 supports ISM-1702 by ensuring the scanning target list is complete and current, but it does not itself perform vulnerability scanning or specify asset classes in scope for scanning.
This control depends on E8-PO-ML1.2.
ISM-1702 requires organisations to use a vulnerability scanner at least fortnightly to identify missing operating system patches on specified non-internet-facing assets. E8-PO-ML1.2 requires that vulnerability scanning activities use a scanner with an up-to-date vulnerability database. ISM-1702 is dependent on E8-PO-ML1.2 in practice because the required scanning for missing patches is not reliable or meaningful without current vulnerability/signature content.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.