ASD ISM 1808 Vulnerability scanning with updated tools
What it says
A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure vulnerability scanners are updated regularly to identify system weaknesses.
You need to use a vulnerability scanner that is kept up to date to find weaknesses in your systems. If you don't keep the scanner updated, you might miss security holes that hackers could exploit, leading to data breaches or other serious issues.
Free. Save your status, tasks and notes.
Why it matters
If vulnerability scanners or their databases are outdated, scans miss known CVEs, leaving exposed weaknesses that attackers can exploit.
How to implement
System owners should ensure that a reliable vulnerability scanner is selected for scanning activities.
They can do this by researching products that are known for frequent updates and compatibility with their systems.
The IT team should schedule regular updates for the vulnerability scanner.
Set a specific calendar reminder to check and apply updates, ideally monthly, or whenever new updates are released by the vendor.
Managers should coordinate with their IT teams to ensure that vulnerability scans are consistently performed.
They can do this by setting up a recurring task in project management software and checking in weekly.
Procurement officers should acquire licences for the vulnerability scanning tool.
They can ensure compliance by purchasing from approved vendors who provide regular updates and support.
The IT team should prepare a report of identified vulnerabilities following each scan.
This can be done by exporting and summarising scan results, then prioritising issues based on risk.
Keep it running
Update the scanner engine and vulnerability database at least weekly (or sooner if available) and verify updates before scheduled scans run.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The vulnerability scanner's update logs.
Look at
The most recent update date and the frequency of updates over the past year.
Good evidence
Shows regular updates, at least monthly.
- Check 2 of 5What an auditor asks for
Look at
Entries about detected vulnerabilities and the date of the scan.
Good evidence
Report clearly lists recent scans with detailed findings and dates.
- Check 3 of 5What an auditor asks for
Ask for
To see a schedule of when vulnerability scans are conducted.
Look at
The planned frequency and actual logs of past scans.
Good evidence
Shows a consistent and frequent scanning routine, like monthly scans.
- Check 4 of 5What an auditor asks for
Look at
Evidence of evaluation against other tools.
Good evidence
Will show a deliberate choice based on current needs and update availability.
- Check 5 of 5What an auditor asks for
Ask for
Meeting notes discussing the results of scans with relevant action items.
Look at
Evidence of meetings and decisions made to address found vulnerabilities.
Good evidence
Includes dated notes showing decisions and follow-up actions.
Mappings
Closest match in ASD Essential Eight: E8-PA-ML1.2, Up-to-date vulnerability scanner used for scanning activities, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1808 requires a specific technical measure: using a vulnerability scanner with an up-to-date vulnerability database for scanning activities. ISO/IEC 27001:2022 Annex A 8.8 requires organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures. ISM-1808 is one concrete method that can satisfy part of Annex A 8.8, but Annex A 8.8 is broader than scanning tool updates and includes evaluation and remediation activities.
ASD Essential Eight: 7 mappings
This control is equivalent to E8-PA-ML1.2.
E8-PA-ML1.2 requires that vulnerability scanning activities use a vulnerability scanner with an up-to-date vulnerability database. ISM-1808 states the same requirement: using a vulnerability scanner with an up-to-date vulnerability database for vulnerability scanning. The scope and depth align closely, with both focusing on tool currency as a baseline condition for scanning quality.
This control is equivalent to E8-PO-ML1.2.
E8-PO-ML1.2 requires that vulnerability scanning activities use a vulnerability scanner with an up-to-date vulnerability database. ISM-1808 states the same requirement: a vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities. The scope and intent align closely, with both controls focusing on ensuring scanner intelligence is current rather than prescribing scanning frequency or remediation actions.
This control partially overlaps E8-PO-ML1.3.
ISM-1808 requires the use of a vulnerability scanner with an up-to-date vulnerability database for vulnerability scanning activities. E8-PO-ML1.3 requires at least daily vulnerability scanning of internet-facing servers and network devices to identify missing operating system patches. ISM-1808 supports E8-PO-ML1.3 by ensuring the tool used for those daily scans can detect newly disclosed vulnerabilities, but it does not set the daily frequency or the specific internet-facing OS scope.
This control supports E8-PA-ML1.3.
E8-PA-ML1.3 requires daily vulnerability scanning to identify missing patches or updates for vulnerabilities in online services. ISM-1808 requires the vulnerability scanner to have an up-to-date vulnerability database, which is necessary for E8-PA-ML1.3 scanning results to be accurate and complete. Without ISM-1808, the daily scanning in E8-PA-ML1.3 can be performed but would be materially less effective and potentially misleading.
This control supports E8-PO-ML1.4.
E8-PO-ML1.4 requires fortnightly vulnerability scanning to identify missing OS patches on internal systems. ISM-1808 requires that the vulnerability scanner used has an up-to-date vulnerability database, which is a prerequisite for the scans in E8-PO-ML1.4 to accurately detect missing patches and relevant vulnerabilities. E8-PO-ML1.4 specifies cadence and target asset types, while ISM-1808 specifies tool currency/quality needed to make those scans reliable.
This control supports E8-PO-ML3.1.
E8-PO-ML3.1 requires fortnightly vulnerability scanning to identify missing driver patches or updates. ISM-1808 requires that the vulnerability scanner used has an up-to-date vulnerability database. To reliably meet E8-PO-ML3.1's intent (accurately identifying missing driver patches), the tooling condition in ISM-1808 is a practical prerequisite for meaningful scanning outcomes.
This control supports E8-PO-ML3.2.
E8-PO-ML3.2 requires fortnightly vulnerability scanning to identify missing firmware patches or updates. ISM-1808 requires that the vulnerability scanner used has an up-to-date vulnerability database, which is necessary for E8-PO-ML3.2 scanning results to be accurate and actionable for firmware. E8-PO-ML3.2 sets the activity and frequency, while ISM-1808 sets a prerequisite quality condition for the scanning tool.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.