ASD ISM 1901 Timely application of non-critical security patches
What it says
Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishApply non-critical software patches within two weeks to maintain system security.
This control is about making sure any updates to your software that aren't urgent are still applied in a timely manner. It's important because even if a security risk isn't immediately dangerous, leaving it unpatched could allow someone to eventually find a way to exploit it, potentially putting your data and systems at risk.
Free. Save your status, tasks and notes.
Why it matters
Delaying non-critical patches beyond two weeks can expose browsers, email/PDF and security tools to emerging exploits, risking compromise and data integrity.
How to implement
The IT team should keep a calendar of software updates: They need to track when updates are released by software vendors.
They can do this by subscribing to vendor mailing lists or using update management tools to receive notifications.
The IT manager should assign a person responsible for testing updates: This person should be tasked with testing the updates in a controlled environment.
They can do this by setting up a test system that mimics the actual system where the updates can be applied without risk to operations.
System administrators should schedule update installations: Once tested, they should plan to apply these updates to the production systems within two weeks.
This can be managed by setting up reminders and using update management software to automate the process where possible.
The IT support team should inform staff about upcoming updates: They should communicate the schedule to all staff to ensure that any disruptions are minimised and staff know what to expect.
This can be done through email announcements or a notice on the company's intranet.
System owners should review update success: After updates are applied, they should check that everything is functioning correctly and that no issues have arisen from the new updates.
They should verify this through direct feedback from users and by reviewing system logs for any anomalies.
Keep it running
Track vendor advisories for browsers, office/email/PDF and security products; confirm "non-critical" and no known exploits, then deploy updates within 14 days.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The update schedule: Request the calendar or list of planned software updates.
Look at
Updates scheduled within a two-week window after release.
Good evidence
Shows all updates listed with clear dates and responsible persons assigned.
- Check 2 of 5What an auditor asks for
Ask for
Testing records: Request documentation or reports on update testing.
Look at
Details about test environments used and any issues found and fixed.
Good evidence
Includes test results with descriptions of fixes applied.
- Check 3 of 5What an auditor asks for
Ask for
To see update communication emails: Request copies of staff notifications about the updates.
Look at
Emails or announcements that clearly inform staff of the update schedule and potential impacts.
Good evidence
Shows clear, timely communication before updates.
- Check 4 of 5What an auditor asks for
Ask for
To view system logs post-updates: Request log files from systems after updates were applied.
Look at
Entries that confirm the updates occurred successfully without errors.
Good evidence
Is logs showing updates applied with no adverse events recorded.
- Check 5 of 5What an auditor asks for
Ask for
A review report: Request a report that details any post-update issues found by users.
Look at
Documented feedback from users that aligns with system performance post-update.
Good evidence
Is positive user feedback and confirmation of intended update benefits.
Mappings
Closest match in ASD Essential Eight: E8-PA-ML3.2, Apply patches for non-critical vulnerabilities within two weeks, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1901 requires a specific vulnerability treatment action: applying non-critical patches within two weeks for a defined set of high-risk application types when no exploits exist. ISO/IEC 27001:2022 Annex A 8.8 requires organisations to obtain information about technical vulnerabilities, assess exposure, and take appropriate measures. ISM-1901 is a prescriptive, time-bound subset of the broader vulnerability management expectations in Annex A 8.8.
ASD Essential Eight: 4 mappings
This control is equivalent to E8-PA-ML3.2.
E8-PA-ML3.2 requires patches for non-critical vulnerabilities in office suites, browsers, email clients, PDF software, and security products to be applied within two weeks when no working exploits exist. ISM-1901 mirrors these conditions, software scope, and timeframe. Implementing either largely satisfies the other.
This control partially meets E8-PA-ML1.7.
E8-PA-ML1.7 requires patches for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software and security products to be applied within two weeks of release, whatever the severity. ISM-1901 sets the same two-week timeframe for the same applications but only for vulnerabilities vendors assess as non-critical where no working exploits exist, so it is a subset of E8-PA-ML1.7.
This control partially overlaps E8-PA-ML3.1.
E8-PA-ML3.1 requires applying mitigations within 48 hours for critical or exploited vulnerabilities in specific end-user application categories and security products. ISM-1901 addresses the same application categories but sets a two-week timeframe when vulnerabilities are non-critical and have no working exploits. The controls overlap on patching the same application set, but differ fundamentally on the urgency trigger (critical/exploited vs non-critical/no exploit) and required remediation timeline.
This control depends on E8-PA-ML1.4.
E8-PA-ML1.4 requires weekly scanning to identify missing patches or updates for vulnerabilities in key user applications and security products. ISM-1901 requires applying patches for the same software categories within two weeks where vendors rate vulnerabilities as non-critical and no working exploits exist. E8-PA-ML1.4 supports ISM-1901 by helping identify which non-critical updates are missing, but ISM-1901 adds conditional decision criteria and a remediation requirement beyond scanning.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.