ASD ISM 1703 Regular vulnerability scanning for missing patches
What it says
A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishA scanner checks every two weeks to find missing security patches for drivers.
Every two weeks, it's crucial for someone to run a check on computers and other devices to see if any important updates or patches are missing. If these checks aren't done, devices might have security holes that cybercriminals could exploit to access sensitive information.
Free. Save your status, tasks and notes.
Why it matters
Without fortnightly vulnerability scans, missing driver patches can go undetected, increasing exposure to known exploits and potential compromise.
How to implement
The IT team should schedule regular vulnerability scans to identify missing patches.
They can use a dedicated software tool to automatically scan devices every two weeks, ensuring updates are immediately flagged.
The office manager or IT administrator should maintain a list of all devices in the company.
This list helps ensure the scanning tool covers every piece of equipment that could have outdated patches.
The system owner should review the scan reports to understand which patches are missing.
They should prioritise updates based on the severity of the vulnerabilities found, focusing first on those marked as critical.
The IT team should document a process for applying patches promptly.
This process might involve setting specific days for applying updates or allowing automatic installation of patches outside of working hours to minimise disruption.
The office manager should communicate the importance of patching security holes to all staff.
They can send out a short, friendly email explaining why these updates are important, assuring everyone that this is about keeping the whole business safe.
Keep it running
Run vulnerability scans at least every fortnight, review findings quickly, and track missing driver patches to remediation based on risk and exposure.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The latest vulnerability scan report.
Look at
The list of discovered vulnerabilities and missing patches.
Good evidence
Shows a regularly updated report with clear actions taken for each identified vulnerability.
- Check 2 of 5What an auditor asks for
Ask for
To see the schedule for vulnerability scans.
Look at
Whether scans are planned at least every two weeks.
Good evidence
Includes a documented schedule that aligns with fortnightly scanning.
- Check 3 of 5What an auditor asks for
Ask for
The device inventory list. Check that the list is up-to-date and complete.
Good evidence
Has all devices listed, including their current patch status, and is checked regularly.
- Check 4 of 5What an auditor asks for
Ask for
Documents outlining the patch management process.
Look at
Detailed steps on how patches are identified, prioritised, and applied.
Good evidence
Describes a clear process that ensures patches are applied consistently.
- Check 5 of 5What an auditor asks for
Ask for
Communication records to staff about patching. Review these to see if they explain security risks and the importance of updates.
Good evidence
Includes emails or memos sent to staff that explain why keeping systems updated is crucial.
Mappings
Closest match in ASD Essential Eight: E8-PO-ML3.1, Vulnerability scanner used fortnightly to identify missing driver patches, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1703 requires a specific operational practice: using a vulnerability scanner at least fortnightly to identify missing patches or updates for vulnerabilities in drivers. Annex A 8.8 requires organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures, without prescribing a specific tool or frequency. ISM-1703 is therefore a more prescriptive and narrower implementation approach that can help satisfy part of Annex A 8.8's broader vulnerability management expectations.
ASD Essential Eight: 10 mappings
This control is equivalent to E8-PO-ML3.1.
E8-PO-ML3.1 requires a vulnerability scanner to be used at least fortnightly to identify missing driver patches or updates. ISM-1703 states the same requirement with the same frequency and the same driver-focused scope. Implementing either control would largely satisfy the other with no material difference in intent or coverage.
This control is broader than E8-PA-ML1.2.
E8-PA-ML1.2 requires that vulnerability scanning activities use a scanner with an up-to-date vulnerability database. ISM-1703 requires at least fortnightly vulnerability scanning to identify missing patches/updates for vulnerabilities in drivers, which depends on current vulnerability data to detect relevant missing updates. ISM-1703 is narrower in asset scope (drivers) and more prescriptive about cadence than E8-PA-ML1.2, which is a general scanner currency requirement.
This control partially overlaps E8-AC-ML3.3.
E8-AC-ML3.3 requires organisations to implement Microsoft's vulnerable driver blocklist to stop known vulnerable drivers from running. ISM-1703 relates by requiring regular vulnerability scanning to identify missing patches or updates for driver vulnerabilities, which helps discover and remediate the same class of driver risk that the blocklist mitigates at runtime. The blocklist is an execution prevention control, whereas ISM-1703 is a detection/assessment control and does not by itself prevent a vulnerable driver from loading.
This control partially overlaps E8-PA-ML1.4.
E8-PA-ML1.4 requires weekly vulnerability scanning to identify missing patches or updates for key end-user and security applications. ISM-1703 requires vulnerability scanning at least fortnightly to identify missing patches or updates for drivers. The controls overlap on scanner-based identification of missing updates, but they differ materially in asset type (applications vs drivers) and required cadence (weekly vs fortnightly).
This control partially overlaps E8-PA-ML2.1.
ISM-1703 requires a vulnerability scanner to be used at least fortnightly to identify missing driver patches or updates. E8-PA-ML2.1 requires the same type of scanning at the same frequency, but for a broad set of non-core applications. ISM-1703 and E8-PA-ML2.1 overlap on the vulnerability scanning process and cadence, while differing in asset class (drivers vs applications).
This control partially overlaps E8-PO-ML1.3.
E8-PO-ML1.3 requires daily vulnerability scanning aimed at identifying missing patches/updates for OS vulnerabilities on internet-facing servers and network devices. ISM-1703 requires at least fortnightly vulnerability scanning to identify missing patches/updates for vulnerabilities in drivers. They overlap in using vulnerability scanning to find missing updates, but differ in technical scope (OS on internet-facing infrastructure vs drivers generally) and in required frequency.
This control partially overlaps E8-PO-ML1.4.
ISM-1703 requires a fortnightly vulnerability scan to identify missing patches or updates for driver vulnerabilities. E8-PO-ML1.4 also mandates at least fortnightly vulnerability scanning for missing patches, but targets operating systems on workstations, non-internet-facing servers, and non-internet-facing network devices. ISM-1703 and E8-PO-ML1.4 overlap on the scanning practice and cadence, but cover different components (drivers vs OS/network device OS).
This control partially overlaps E8-PO-ML3.2.
ISM-1703 requires using a vulnerability scanner at least fortnightly to identify missing patches or updates for vulnerabilities in drivers. E8-PO-ML3.2 uses the same scanning approach and cadence, but applies it to firmware rather than drivers. ISM-1703 and E8-PO-ML3.2 therefore overlap on the vulnerability scanning mechanism and frequency, but differ in the technology layer being assessed.
This control depends on E8-PA-ML1.1.
E8-PA-ML1.1 requires running automated asset discovery at least fortnightly to identify assets that should be included in vulnerability scanning activities. ISM-1703 requires using a vulnerability scanner at least fortnightly to identify missing patches or updates for vulnerabilities in drivers. E8-PA-ML1.1 supports ISM-1703 by helping ensure hosts and devices that contain drivers are discovered and therefore included in scanning scope, although it does not address driver-level scanning itself.
This control depends on E8-PO-ML1.1.
ISM-1703 requires a vulnerability scanner be used at least fortnightly to identify missing driver patches or updates. E8-PO-ML1.1 mandates automated asset discovery at least fortnightly to enable subsequent vulnerability scanning. E8-PO-ML1.1 supports ISM-1703 by ensuring systems that require driver patch assessment are discovered and brought into scanning scope, but it is not a substitute for the scanning requirement itself.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.