ASD ISM 1876 Apply critical patches within 48 hours
What it says
Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishInstall critical patches for online services within 48 hours when notified by the vendor or if exploits are present.
This control is all about being quick to fix critical issues in your online services. When a vendor releases an important update or a security hole has been found, it's crucial to patch it within 48 hours. This prevents hackers from exploiting known weaknesses, which could lead to data breaches, financial loss, or damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
Failure to apply critical patches within 48 hours can allow rapid exploitation of known flaws in online services, causing breaches and outage.
How to implement
IT team should monitor for updates: Regularly check for alerts and emails from your software vendors about critical updates.
Use an updates dashboard or sign up for email alerts to stay informed.
System owners should prioritise critical updates: Create a list of essential online services and their vulnerabilities.
Make sure these are patched first by setting them as a priority in your patch management software.
Managers should allocate resources for quick response: Ensure enough staff are available to test and apply patches within the required timeframe.
This might involve scheduling on-call personnel specifically for critical patch days.
IT support should establish a routine patching process: Develop a step-by-step guide for deploying patches that includes backing up systems, applying updates, and testing them in a non-production environment first to minimise disruption.
Document patch applications: The IT team should keep records of when and how updates are applied, detailing any issues encountered.
Use a spreadsheet or digital log to track patch status and follow-up actions.
Keep it running
Monitor vendor alerts for critical or exploited flaws and use an emergency change process to deploy patches to online services within 48 hours.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The patch logs from the IT department: Request documentation showing when updates were received and applied.
Look at
Timestamps within the 48-hour window for critical patches.
Good evidence
Includes exact patch dates and times that match vendor release notes.
- Check 2 of 5What an auditor asks for
Look at
Prioritisation criteria and ensure they align with business needs and vendor assessments.
Good evidence
Clearly defined critical systems with documented approval.
- Check 3 of 5What an auditor asks for
Ask for
Change management records: Request records that track changes made during patch application.
Look at
Descriptions of the patch, systems affected, and outcomes of testing before full deployment.
Good evidence
Includes thorough notes with no significant downtime or issues reported.
- Check 4 of 5What an auditor asks for
Look at
Clear identification of critical updates.
Good evidence
Includes a routine acknowledgment system marking critical items as urgent.
- Check 5 of 5What an auditor asks for
Ask for
Documented procedures in case a patch fails.
Look at
Fallback strategies like rollbacks or backups.
Good evidence
Provides a step-by-step action plan, tested and ready to ensure systems remain operational.
Mappings
Closest match in ASD Essential Eight: E8-PA-ML1.5, Apply critical online service patches within 48 hours, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1876 requires critical patches or vendor mitigations for online services to be applied within 48 hours when vendors rate vulnerabilities as critical or when working exploits exist. ISO/IEC 27001:2022 Annex A 8.8 requires organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures, without prescribing a specific 48-hour timeframe or limiting scope to online services. ISM-1876 is a specific, time-bound implementation within the broader vulnerability management expectations of Annex A 8.8.
ASD Essential Eight: 5 mappings
This control is equivalent to E8-PA-ML1.5.
E8-PA-ML1.5 requires patches, updates or vendor mitigations for critical vulnerabilities in online services to be applied within 48 hours of release (including where working exploits exist). ISM-1876 states the same 48-hour requirement for critical vendor-assessed vulnerabilities or where working exploits exist in online services. The scope, trigger conditions and timeframe align closely such that implementing one would largely satisfy the other.
This control partially overlaps E8-PA-ML1.6.
E8-PA-ML1.6 requires patching vulnerabilities in online services within two weeks when vendors assess them as non-critical and no working exploits exist. ISM-1876 also targets online services but mandates a much shorter 48-hour timeframe when vulnerabilities are critical or working exploits exist. They overlap on the same asset class (online services) and patching activity, but differ on severity/exploit conditions and required urgency.
This control partially overlaps E8-PO-ML1.5.
E8-PO-ML1.5 requires critical vendor patches or mitigations to be applied within 48 hours for operating systems on internet-facing servers and internet-facing network devices when rated critical or when exploits exist. ISM-1876 imposes the same 48-hour critical/exploited patching requirement but for vulnerabilities in online services rather than specifically OS on internet-facing servers/devices. They align on urgency and triggering conditions, but differ on technical scope (online services vs operating systems on internet-facing infrastructure).
This control partially overlaps E8-PO-ML3.3.
ISM-1876 requires applying critical patches for vulnerabilities in online services within 48 hours based on vendor criticality or the presence of working exploits. E8-PO-ML3.3 also mandates a 48-hour patch window for critical vulnerabilities, but for operating systems on workstations and non-internet-facing servers/network devices. The time-and-trigger logic is the same, however the technology scope differs (online services vs non-internet-facing OS assets).
This control partially overlaps E8-PO-ML3.7.
ISM-1876 requires critical patches or mitigations for vulnerabilities in online services within 48 hours when vendors rate them critical or when working exploits exist. E8-PO-ML3.7 applies the same urgency and triggers to firmware vulnerabilities. They share the same patching timeliness requirement, but address different asset categories (online services versus firmware).
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.