ASD ISM 1879 Timely patching of critical driver vulnerabilities
What it says
Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCritical driver vulnerabilities must be fixed within 48 hours to prevent exploits.
This control is about fixing known problems in software drivers, which are bits of code that help your computer talk to its hardware, as soon as possible. If these problems aren't fixed quickly, hackers might find a way to exploit them, which could lead to data breaches or system shutdowns.
Free. Save your status, tasks and notes.
Why it matters
Delaying critical driver patches can allow rapid exploitation, leading to privilege escalation, data theft, or service disruption.
How to implement
The IT team should set up a monitoring system to track when software vendors release updates or patches.
They can do this by subscribing to vendor notifications via email or using a software tool that alerts them to new updates.
The manager responsible for IT should ensure there is a clear process for categorising driver updates as critical, based on vendor assessments.
They can maintain a checklist that the IT team uses whenever an update is released to quickly determine its importance.
System administrators should coordinate the testing and application of these critical patches.
They should follow a documented procedure that includes backing up essential systems before applying any update to ensure only safe changes are made.
The procurement team should maintain contact information for all vendors.
They need to ensure the contracts specify the vendor's responsibility to provide timely updates when vulnerabilities are identified.
The office manager should schedule regular team meetings to discuss cyber security updates.
During these meetings, the IT team can report on recent updates, their importance, and any issues that occurred during their application.
Keep it running
Apply driver mitigations within 48 hours when vendors rate issues critical or exploits exist; automate alerts and track deployment to completion.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The vendor notifications log: Request a report or emails that show when critical driver updates were announced by vendors.
Look at
Timestamps that match up with when updates were released.
Good evidence
Is a complete record showing all updates with relevant dates.
- Check 2 of 5What an auditor asks for
Ask for
The driver update process documentation.
Look at
This documentation to see how updates are categorised and prioritised.
Good evidence
Document clearly outlines steps for identifying and classifying critical updates and demonstrates a history of correct categorisation.
- Check 3 of 5What an auditor asks for
Ask for
A systems backup record: Check for logs or records that show backups were taken before patches were applied.
Good evidence
Example is a backup log indicating dates and times of system backups corresponding to update events.
- Check 4 of 5What an auditor asks for
Ask for
The IT team meeting minutes: These should record discussions about recent cyber security updates and procedures. Good minutes record specific updates discussed, any decisions made, and assigned actions regarding patch application.
- Check 5 of 5What an auditor asks for
Ask for
Signed vendor agreements: Review these agreements to ensure they include clauses on the timely provision of software updates.
Good evidence
Shows explicit vendor obligations regarding update disclosures and timeframes.
Mappings
Closest match in ASD Essential Eight: E8-PO-ML3.5, Apply critical driver patches within 48 hours, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1879 requires a specific, time-bound action: applying patches, updates or mitigations for critical driver vulnerabilities within 48 hours when vendor-critical or exploited. ISO/IEC 27001:2022 Annex A 8.8 requires organisations to obtain information about technical vulnerabilities, assess exposure, and take appropriate measures. ISM-1879 is a concrete, driver-focused and time-specific implementation that fits within the broader vulnerability management expectations of Annex A 8.8.
ASD Essential Eight: 4 mappings
This control is equivalent to E8-PO-ML3.5.
E8-PO-ML3.5 requires organisations to apply vendor patches or mitigations for critical driver vulnerabilities within 48 hours (or when working exploits exist). ISM-1879 states the same driver-specific 48-hour requirement under the same criticality/exploit conditions. The scope, trigger conditions and timeframe align closely, so meeting ISM-1879 would largely satisfy E8-PO-ML3.5.
This control partially overlaps E8-PA-ML1.5.
E8-PA-ML1.5 requires applying critical patches for online services within 48 hours when rated critical or exploited. ISM-1879 requires the same 48-hour treatment but for critical vulnerabilities in drivers. They overlap when driver vulnerabilities affect systems delivering online services, but ISM-1879 is broader across endpoint/server drivers while E8-PA-ML1.5 is limited to online services.
This control partially overlaps E8-PO-ML1.5.
E8-PO-ML1.5 requires critical vendor patches or mitigations to be applied within 48 hours for operating systems on internet-facing servers and internet-facing network devices when rated critical or when exploits exist. ISM-1879 applies the same 48-hour critical/exploited patching expectation but targets vulnerabilities in drivers, not specifically internet-facing OS on servers/devices. The controls overlap on the 48-hour remediation requirement and trigger conditions, but cover different asset classes and exposure assumptions.
This control depends on E8-PO-ML1.2.
ISM-1879 requires organisations to apply critical driver patches or mitigations within 48 hours when vendor-critical or exploited, which presumes the organisation can reliably identify relevant driver vulnerabilities and missing patches. E8-PO-ML1.2 requires using a vulnerability scanner with an up-to-date database, enabling accurate identification of vulnerabilities and missing updates that must be remediated to meet ISM-1879 timeframes. Without up-to-date scanning intelligence, meeting a strict 48-hour driver patch SLA is significantly hindered.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.