ASD ISM 1751 Timely application of vendor patches for non-critical OS vulnerabilities
What it says
Patches, updates or other vendor mitigations for vulnerabilities in operating systems of IT equipment other than workstations, servers and network devices are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishApply OS patches for non-critical issues within a month if no exploits exist.
This control requires that updates for minor security issues in the operating systems of certain IT equipment be applied within a month, as long as no known security hacks are taking advantage of these issues. This matters because even small vulnerabilities can be discovered and exploited by cybercriminals over time, potentially leading to data breaches or disruption of services if not addressed in time.
Free. Save your status, tasks and notes.
Why it matters
Neglecting non-critical OS patches on non-server/workstation equipment can leave known flaws unpatched, enabling compromise of less monitored IT devices.
How to implement
The IT team should set a regular schedule to check for any new patches or updates from software vendors for non-critical vulnerabilities.
They can do this by subscribing to vendor update notifications or regularly visiting vendor websites to ensure they don't miss any updates.
System owners should note down which pieces of equipment are eligible for these updates, focusing on those that aren't standard workstations, servers, or network devices.
They should create a list and update it periodically in case new equipment is added.
The IT team should apply any found patches to the respective equipment within a month of release.
This can often be done through remote management tools or during maintenance windows to avoid disrupting business operations.
Management should ensure communication channels are set up where the IT team can report back on which patches have been applied, keeping everyone informed.
A brief weekly check-in can help track progress and resolve any issues quickly.
The office manager can monitor and support the process by ensuring the IT team has the resources and time they need to apply these patches promptly.
This might include approving overtime or allocating budget for necessary tools or training.
Keep it running
Track vendor OS patch releases for non-server/workstation/network devices and apply non-critical fixes within 1 month when no working exploits are known.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The patch management schedule: Request a copy of the schedule or calendar that the IT team uses to track patch release dates and application deadlines. Look to see if the schedule includes timelines for non-critical patch applications.
Good evidence
Shows regular, documented intervals aligning with monthly update windows.
- Check 2 of 5What an auditor asks for
Good evidence
Contains specific entries with a focus on non-standard IT equipment.
- Check 3 of 5What an auditor asks for
Ask for
Recent patch implementation reports.
Look at
Records showing which patches were applied to which pieces of equipment and when.
Good evidence
Is a detailed log of the most recent patches applied within the last month.
- Check 4 of 5What an auditor asks for
Ask for
The documented vendor communications that indicate new patches have been released.
Look at
Dates and patch details.
Good evidence
Is timely, showing regular checks and alerts from trusted vendors.
- Check 5 of 5What an auditor asks for
Ask for
Meeting minutes or notes from patch update check-ins.
Look at
Documentation that these meetings or briefings are happening and determining the next steps for patching.
Good evidence
Is regular, with actionable items tracked and resolved.
Mappings
Closest match in ISO/IEC 27001: A.8.8, Management of technical vulnerabilities, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1751 requires a specific patching outcome: non-critical vendor OS vulnerabilities (with no working exploits) on certain IT equipment are remediated within one month. ISO/IEC 27001:2022 Annex A 8.8 requires organisations to obtain information about technical vulnerabilities, assess exposure, and take appropriate measures, without prescribing a specific timeframe or limiting to OS-only vulnerabilities. ISM-1751 is therefore a concrete, time-bound subset implementation of the broader vulnerability management expectations in Annex A 8.8.
ASD Essential Eight: 1 mapping
This control partially overlaps E8-PO-ML3.4.
E8-PO-ML3.4 requires non-critical OS patching within one month for workstations, non-internet-facing servers and non-internet-facing network devices when no working exploits exist. ISM-1751 applies the same non-critical/no-exploit and one-month requirement, but for OS on IT equipment other than workstations, servers and network devices. They align on the patching rule and timing, but apply to different asset categories, so each leaves gaps the other does not cover.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.