ASD ISM 1878 Apply critical patches within 48 hours
What it says
Patches, updates or other vendor mitigations for vulnerabilities in operating systems of IT equipment other than workstations, servers and network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCritical system updates must be installed within 48 hours to prevent security risks.
Critical security updates for your IT systems should be installed within 48 hours when deemed critical by vendors. This is crucial because failing to act quickly could leave your systems vulnerable to cyber attacks, which can lead to data breaches, financial losses, and damage to your reputation.
Free. Save your status, tasks and notes.
Why it matters
If critical OS patches are not applied within 48 hours, known or exploited vulnerabilities may be rapidly abused, causing outages, data compromise and financial loss.
How to implement
Assign responsibility: Designate an IT team member or specialist to monitor security update announcements from your software vendors.
They should subscribe to vendor notifications or alerts to stay informed about any new patches.
Establish a patching schedule: Your IT team should create and maintain a calendar that outlines when critical updates need to be applied.
This can be done by setting reminders and regularly checking in with vendors for any critical updates.
Create a testing environment: An IT technician should set up a separate testing environment to trial new patches before applying them company-wide.
This helps ensure that updates don't disrupt your systems.
Implement an approval process: Managers should establish a quick approval process for applying critical patches.
This can be a simple protocol where the IT team explains the necessity of the patch to decision-makers without delay.
Automate where possible: Use patch management software if budget allows, to automatically apply critical patches.
Your IT team can set thresholds to identify which types of updates should automatically be applied.
Keep it running
Monitor vendor advisories and exploit intel, prioritise critical OS patches for non-workstation/server/network devices, and automate deployment to meet the 48-hour window.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Patch management policy: Review the organisation's document outlining how patches are managed.
Look at
Specific procedures for handling and applying critical patches.
Good evidence
Includes a detailed policy that specifies timelines and responsibilities for patching.
- Check 2 of 5What an auditor asks for
Ask for
Records of applied patches from the IT team, ideally over the last six months.
Look at
The time between release and application dates.
Good evidence
Log shows patches applied within 48 hours of release when marked critical.
- Check 3 of 5What an auditor asks for
Look at
Email subscriptions or dashboard settings that confirm alerts are being received.
Good evidence
Shows active subscription to multiple vendor alert systems.
- Check 4 of 5What an auditor asks for
Ask for
Recent case examples: Request a demonstration or report of a recent critical patch application.
Look at
How quickly and effectively the patch was implemented.
Good evidence
Includes prompt action logs and minimal disruption reports.
- Check 5 of 5What an auditor asks for
Look at
Documentation or walkthroughs detailing how patches are tested.
Good evidence
Process includes a logical setup and evidence of regular use.
Mappings
Closest match in ISO/IEC 27001: A.8.8, Management of technical vulnerabilities, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1878 requires critical OS patches to be applied within 48 hours for certain categories of IT equipment when vendors rate vulnerabilities as critical or when working exploits exist. ISO/IEC 27001:2022 Annex A 8.8 requires organisations to obtain information about technical vulnerabilities, evaluate exposure, and take appropriate measures, which can include patching but is not limited to it. ISM-1878 is a prescriptive, time-bound patching requirement that fits within the broader vulnerability management expectations of Annex A 8.8.
ASD Essential Eight: 2 mappings
This control partially overlaps E8-PO-ML1.5.
ISM-1878 requires critical OS patches for IT equipment (other than workstations, servers and network devices) to be applied within 48 hours when rated critical or when working exploits exist. E8-PO-ML1.5 aligns on the same 48-hour trigger, but applies specifically to internet-facing servers and internet-facing network devices. The time/trigger logic overlaps, however the asset scope is largely different (internet-facing servers/network devices vs other types of IT equipment).
This control partially overlaps E8-PO-ML3.3.
ISM-1878 mandates applying critical OS patches within 48 hours for IT equipment other than workstations, servers and network devices, based on vendor criticality or known working exploits. E8-PO-ML3.3 requires the same 48-hour patching outcome but for workstations, non-internet-facing servers and non-internet-facing network devices. They share the patch-timeliness and trigger conditions, but cover different classes of assets.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.