ASD ISM 1807 Automated asset discovery for vulnerability scanning
What it says
An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishAutomatically find devices every two weeks to check for security problems.
Imagine if a burglar could sneak into your home because you didn't know a window was open. This control is about making sure you regularly check to find all the devices on your network, so you can identify and fix security issues. If you don't do this, you might miss vulnerable devices, risking data leaks or system downtime.
Free. Save your status, tasks and notes.
Why it matters
Without fortnightly automated asset discovery, assets can be missed from vulnerability scanning, leaving exploitable weaknesses and increasing breach risk.
How to implement
Business owners should ensure a service provider or IT professional sets up automated tools to scan the network for devices every two weeks.
These tools look for all the devices connected to your network and report back with a list.
IT teams should review logs from these scans to ensure all company devices are found.
They do this by cross-referencing with a documented inventory of known devices, ensuring nothing is missing or unexpected.
Managers should schedule regular meetings with their IT staff to go over scan reports.
These meetings should focus on identifying any new devices and ensuring they are approved for use on the network.
Procurement officers should work with IT teams to ensure any new hardware purchases are added to the network scanning list immediately.
This helps in keeping an up-to-date inventory that aligns with the scanning reports.
System administrators should set automated alerts for when new or unidentified devices appear on the network.
These alerts can notify the team to take immediate action like validating the device or removing it if it's unauthorised.
Keep it running
Schedule automated asset discovery at least fortnightly; reconcile results with the asset register/CMDB and ensure newly found assets are queued for vulnerability scanning.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The list of network-connected devices: Request the output from the latest network scan.
Look at
Evidence of all known devices being listed and check for any unknown devices.
Good evidence
Result is when the device inventory from the scan matches your expected device list.
- Check 2 of 5What an auditor asks for
Ask for
The schedule of scanning activities: Request the documentation that details the schedule of network scans.
Look at
Dates and frequency to ensure scans happen at least fortnightly.
Good evidence
Is a timetable that shows scans occurring every two weeks as planned.
- Check 3 of 5What an auditor asks for
Ask for
Meeting records with IT staff: Request minutes or notes from meetings discussing the scan reports.
Look at
Discussions about new or missing devices and the actions taken.
Good evidence
Record includes dates of meetings, participant names, and follow-up actions.
- Check 4 of 5What an auditor asks for
Ask for
Recent alerts from the network monitoring system: Request evidence of alerts triggered by new devices.
Look at
The frequency and response actions to these alerts.
Good evidence
Scenario is when alerts are promptly acted upon, with records showing investigative steps.
- Check 5 of 5What an auditor asks for
Ask for
The procurement-to-IT update process: Request the document or procedure showing how new devices are logged into the network system.
Look at
Steps ensuring new devices are communicated to the IT team.
Good evidence
Practice is having a clear, documented process with checks and balances included.
Mappings
Closest match in ASD Essential Eight: E8-PA-ML1.1, Automated asset discovery at least fortnightly, which asks for the same thing.
ASD Essential Eight: 3 mappings
This control is equivalent to E8-PA-ML1.1.
E8-PA-ML1.1 requires an automated method of asset discovery to be run at least fortnightly to detect assets for subsequent vulnerability scanning. ISM-1807 states the same requirement with the same cadence and purpose, directly aligning the control intent and implementation outcome. Implementing E8-PA-ML1.1 would largely satisfy ISM-1807 (and vice versa) because both focus on automated discovery as an input to vulnerability scanning coverage.
This control is equivalent to E8-PO-ML1.1.
ISM-1807 requires automated asset discovery at least fortnightly to identify assets for later vulnerability scanning. E8-PO-ML1.1 mirrors this by specifying automated bi-weekly/fortnightly asset discovery explicitly for vulnerability scanning support. There is no material difference in scope or intent between ISM-1807 and E8-PO-ML1.1.
This control supports E8-PO-ML3.2.
E8-PO-ML3.2 requires organisations to scan at least fortnightly to find missing firmware patches and updates. ISM-1807 supports this by requiring at least fortnightly automated asset discovery so firmware-bearing assets are identified and then included in subsequent vulnerability scanning. ISM-1807 does not itself require firmware vulnerability scanning, but it improves completeness and coverage of E8-PO-ML3.2.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.