ASD ISM 1752 Fortnightly vulnerability scanning for non-workstations
What it says
A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of IT equipment other than workstations, servers and network devices.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCheck non-work devices every two weeks for missing security updates.
This control is about ensuring your non-work computers, like those used for special purposes or devices in key roles, are checked every two weeks for missing security updates. It's important because if there are gaps in security patches, these devices can become an easy target for cyber attacks, leading to data breaches or operational disruptions.
Free. Save your status, tasks and notes.
Why it matters
Without fortnightly scanning of non-workstation IT equipment OSs, missing patches may persist and be exploited, causing compromise or service disruption.
How to implement
IT team should schedule recurring bi-weekly tasks to run vulnerability scans.
Use scheduling tools or calendar alerts to ensure this occurs every two weeks without fail. Automate scans where possible to maximise efficiency.
System administrator should choose and configure a reliable vulnerability scanning tool.
Choose software that is easy to use and configure it to look for missing updates specifically on non-workstations like backup servers or IoT devices.
IT manager should maintain a log of all devices that need regular scanning.
Create a checklist or spreadsheet listing all relevant non-work devices to ensure nothing is overlooked during the scans.
Technical support staff should review scan reports and document findings.
After each scan, go through the output to identify missing patches and log details like device, missing update, and date of discovery.
Business owner or office manager should review the scanning reports and actions taken.
Use regular meetings to discuss findings with the IT team to understand any risks and verify they're being addressed timely.
Keep it running
Schedule vulnerability scans at least every 14 days for non-workstation IT equipment operating systems (excluding servers/network devices); track missing patches and verify remediation.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The vulnerability scanning schedule: Request to see the calendar or task list detailing planned scan dates.
Look at
How consistently the scans are scheduled and whether they are set bi-weekly.
Good evidence
A recurring, bi-weekly task setup clearly visible in the schedule.
- Check 2 of 5What an auditor asks for
Ask for
Recent scanning reports: Request the last few scan reports generated by the vulnerability tool.
Look at
The reports to see if any vulnerabilities were identified and actions were taken.
Good evidence
Reports show recent dates with at least two-week intervals and listed vulnerabilities addressed.
- Check 3 of 5What an auditor asks for
Ask for
Documentation of the scanning tool and coverage: Request records showing which scanning tools are used and which devices are covered.
Look at
How comprehensive the list is in terms of non-work devices.
Good evidence
Detailed records listing both the tool specifics and covered devices.
- Check 4 of 5What an auditor asks for
Ask for
The vulnerability management procedure document: Request the procedure guide or policy document that describes the vulnerability scan process.
Look at
It to verify it specifies the use of scans every two weeks.
Good evidence
A documented, clear procedure with bi-weekly scan mandate.
- Check 5 of 5What an auditor asks for
Ask for
Incident response updates: Request to see any recent meetings or notes about responses to vulnerabilities found.
Look at
How promptly and thoroughly the organisation has acted on issues found.
Good evidence
Notes or meeting minutes show timely actions and resolutions on reported vulnerabilities.
Mappings
Closest match in ISO/IEC 27001: A.8.8, Management of technical vulnerabilities, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1752 requires organisations to perform a specific, measurable activity: fortnightly vulnerability scanning to identify missing operating system patches on non-workstation, non-server, and non-network-device equipment. Annex A 8.8 requires obtaining information about technical vulnerabilities, evaluating exposure, and taking appropriate measures, which can be satisfied through multiple approaches including scanning and patch management. ISM-1752 is therefore a prescriptive subset implementation that helps meet the broader vulnerability management expectations in Annex A 8.8.
ASD Essential Eight: 4 mappings
This control partially overlaps E8-PO-ML1.3.
E8-PO-ML1.3 requires daily vulnerability scanning to find missing operating system patches/updates on internet-facing servers and network devices. ISM-1752 requires at least fortnightly vulnerability scanning for missing OS patches/updates, but for other categories of IT equipment (excluding workstations, servers and network devices). The controls overlap in scanning for missing OS updates, however they target different asset classes and ISM-1752 does not address the internet-facing server/network device scope of E8-PO-ML1.3.
This control partially overlaps E8-PO-ML3.2.
ISM-1752 requires organisations to use a vulnerability scanner at least fortnightly to identify missing operating system patches on IT equipment other than workstations, servers, and network devices. E8-PO-ML3.2 also requires fortnightly scanning, but focuses specifically on identifying missing firmware patches/updates rather than operating system patches. They overlap on the scanning cadence and vulnerability scanning practice, but differ in technical scope (OS vs firmware) and in the asset classes explicitly in scope.
This control depends on E8-PA-ML1.1.
E8-PA-ML1.1 requires automated asset discovery at least fortnightly to support detection of assets for later vulnerability scanning. ISM-1752 mandates fortnightly vulnerability scanning for certain non-workstation equipment to find missing patches or updates. E8-PA-ML1.1 supports ISM-1752 by improving visibility of discoverable devices so the scanner coverage includes newly connected or previously unknown assets, but it does not set requirements for the scanning tool or patch findings.
This control depends on E8-PO-ML1.2.
E8-PO-ML1.2 requires that vulnerability scanning uses a scanner with an up-to-date vulnerability database. ISM-1752 requires at least fortnightly scanning to identify missing patches/updates in operating systems for IT equipment other than workstations, servers, and network devices, and accurate identification depends on current vulnerability signatures and data. ISM-1752 defines frequency and a particular scope of equipment that E8-PO-ML1.2 does not specify.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.