ASD ISM 1877 Timely application of critical security patches
What it says
Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishApply critical patches to online systems within 48 hours to prevent vulnerability exploits.
This control is about quickly fixing critical weaknesses in your online systems by updating them within two days of the patch being available. It matters because if you don't update in time, hackers can exploit these vulnerabilities to steal information or cause significant harm to your business.
Free. Save your status, tasks and notes.
Why it matters
Delaying critical patching can expose online systems to known exploits, leading to data breaches and severe operational disruptions.
How to implement
IT staff should monitor for the release of critical patches by software vendors.
They can do this by subscribing to vendor security alerts and regularly checking vendor websites for updates.
The IT team should create a priority system for updates.
They should label each patch as 'critical' or 'non-critical', focusing on 'critical' patches for systems that are exposed to the internet.
Assign a lead IT professional to oversee patch installation on critical systems.
They should ensure the patch is installed within 48 hours by scheduling a time to perform the update and verifying its success afterward.
System owners should verify that critical systems function as expected after patch installation.
They can run a set of basic operational tests to ensure no new problems have arisen.
Office managers should ensure there is a protocol for informing staff about system changes due to critical patch updates.
This can be done through emails or staff meetings, explaining why the updates are crucial for company security.
Keep it running
Automate patch workflows for internet-facing servers/devices; prioritise, test and deploy critical fixes within 48 hours, and record evidence.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A list of installed patches: Request a report showing patches applied to online systems over the past six months.
Look at
The dates when patches were applied.
Good evidence
Report shows updates were applied within 48 hours of their release.
- Check 2 of 5What an auditor asks for
Ask for
The system monitoring logs: Request logs that record when critical patches were identified and flagged. Check these logs for timeliness in identifying critical patches.
Good evidence
Log shows vulnerabilities were identified quickly and within a day.
- Check 3 of 5What an auditor asks for
Ask for
The protocol document for patch management.
Look at
The steps outlined for update prioritisation and application. Good protocol shows a clear distinction between critical and non-critical patches with a timeline of 48 hours for critical updates.
- Check 4 of 5What an auditor asks for
Ask for
Confirmation records from system owners: Review emails or memos confirming post-update testing results. These documents should show successful testing that aligns with operational needs.
Good evidence
Includes timely confirmations free of significant issues.
- Check 5 of 5What an auditor asks for
Ask for
The communication logs to staff.
Look at
Communication records to ensure staff were notified about system updates. Good evidence is emails or meeting notes detailing the importance and timing of critical updates.
Mappings
Closest match in ASD Essential Eight: E8-PO-ML1.5, Apply critical patches to internet-facing OS within 48 hours, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1877 requires a specific remediation outcome: applying critical vendor patches/mitigations to internet-facing operating systems within 48 hours when critical or exploited. ISO/IEC 27001:2022 Annex A 8.8 requires a broader vulnerability management process-obtaining vulnerability information, evaluating exposure, and taking appropriate measures-without prescribing a 48-hour timeframe or limiting scope to internet-facing OS. ISM-1877 is therefore a prescriptive subset implementation of the broader requirement in Annex A 8.8.
ASD Essential Eight: 5 mappings
This control is equivalent to E8-PO-ML1.5.
ISM-1877 requires critical vendor patches/updates/mitigations for operating systems of internet-facing servers and internet-facing network devices to be applied within 48 hours when rated critical or when working exploits exist. E8-PO-ML1.5 states the same 48-hour requirement for the same asset classes and triggering conditions. In practice, implementing E8-PO-ML1.5 would substantially satisfy ISM-1877 for the stated scope.
This control partially overlaps E8-PA-ML1.5.
ISM-1877 focuses on patching operating systems for internet-facing servers and internet-facing network devices within 48 hours when vulnerabilities are critical or exploited. E8-PA-ML1.5 applies an equivalent 48-hour patching expectation, but for vulnerabilities in online services (applications), not OS on servers/network devices. They reinforce a consistent rapid remediation approach for exposed attack surfaces, but cover different technology layers.
- E8-PO-ML1.6Timely application of non-critical patches for internet-facing OS vulnerabilitiesPartially overlaps
This control partially overlaps E8-PO-ML1.6.
E8-PO-ML1.6 requires applying non-critical OS patches to internet-facing servers and network devices within two weeks when no working exploits exist. ISM-1877 covers the same asset scope (internet-facing OS on servers and network devices) but applies to critical vulnerabilities or where working exploits exist, with a much shorter timeframe (48 hours). The controls align on patching internet-facing OS, but differ on severity/exploit conditions and mandated urgency.
This control partially overlaps E8-PO-ML3.3.
ISM-1877 requires critical patching within 48 hours for operating systems on internet-facing servers and internet-facing network devices when vendor-critical or exploited. E8-PO-ML3.3 applies the same 48-hour criticality/exploit trigger but targets non-internet-facing operating systems (workstations, internal servers, internal network devices). They align on the patch urgency logic, but differ materially on which systems are in scope (internet-facing versus internal).
This control depends on E8-PO-ML1.3.
ISM-1877 requires organisations to apply critical patches to internet-facing operating systems within 48 hours when vendor-critical or exploited. E8-PO-ML1.3 requires daily vulnerability scanning to identify missing OS patches on internet-facing servers and internet-facing network devices, which directly enables timely detection and tracking needed to meet the 48-hour patch SLA. Without the visibility and confirmation provided by E8-PO-ML1.3, consistently achieving and evidencing ISM-1877 is significantly harder.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.