ASD ISM 1902 Apply non-critical patches to non-internet systems promptly
What it says
Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure non-critical security patches are applied within a month if no active threats are identified.
This control is about making sure that all non-critical updates for software on internal systems are applied within a month. It's crucial because if these updates aren't applied, even minor vulnerabilities can be exploited by cybercriminals, leading to data breaches or system downtime.
Free. Save your status, tasks and notes.
Why it matters
Delaying vendor-rated non-critical patches on non-internet systems can allow internal attackers to exploit known flaws, escalating access and impacting integrity.
How to implement
The IT team should maintain a clear schedule for applying non-critical patches.
To do this, they can use a spreadsheet or a software tool to track when each patch is released and ensure it gets applied within 30 days.
System administrators should regularly check vendor websites for patch updates.
They can subscribe to email alerts or use automated tools to receive notifications when new security patches are released.
Managers should ensure that there is enough IT support available to review and apply patches.
This can be done by assessing team workloads and adjusting resources, so patch applications don't get delayed.
System owners should communicate with vendors if they face issues applying a patch.
They can do this by calling vendor support hotlines or using online help forums provided by the vendors.
Office managers should have a monthly meeting with the IT team to go over the patching status.
During this meeting, they should check any pending patches, discuss any problems encountered, and plan for future patching needs.
Keep it running
Track vendor releases and apply non-critical OS patches to non-internet-facing workstations, servers and network devices within 30 days where no working exploits exist.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A patch management schedule: Request to see documentation showing when patches are planned to be applied.
Look at
Regular entries within the schedule indicating patches are applied within a month.
Good evidence
Includes a consistently updated schedule demonstrating patch timelines.
- Check 2 of 5What an auditor asks for
Ask for
Patch deployment logs: Request logs that show when patches were actually applied to systems.
Look at
The dates in these logs to verify they match the planned timelines. Good evidence is logs showing all non-critical patches applied within the one-month window.
- Check 3 of 5What an auditor asks for
Ask for
Vendor communication records: Request any communications with vendors regarding patch issues or updates.
Look at
Proactive discussions and resolution outcomes.
Good evidence
Sign is timely responses and resolved issues related to patching successfully documented.
- Check 4 of 5What an auditor asks for
Ask for
Records of IT meetings: Request minutes or notes from meetings where patching was discussed.
Look at
Mentions of upcoming patches, deployment timelines, and any identified risks.
Good evidence
Example would be structured meeting records noting patch priorities and actions.
- Check 5 of 5What an auditor asks for
Ask for
Training material or records: Request documentation or records showing the training system administrators receive regarding update processes.
Look at
The date and relevance of the material provided. Good evidence includes up-to-date training sessions that highlight the importance and process of timely patching.
Mappings
Closest match in ASD Essential Eight: E8-PO-ML3.4, Non-critical OS patches applied within one month if no exploits exist, which asks for the same thing.
ASD Essential Eight: 5 mappings
This control is equivalent to E8-PO-ML3.4.
E8-PO-ML3.4 requires patches, updates or vendor mitigations for non-critical OS vulnerabilities (with no working exploits) to be applied within one month on workstations, non-internet-facing servers and non-internet-facing network devices. ISM-1902 states the same scope (OS on those internal device types), the same conditions (non-critical vendor assessment and no working exploits), and the same timeframe (within one month). Implementing ISM-1902 would therefore largely satisfy E8-PO-ML3.4 for this patching scenario.
- E8-PO-ML1.7One-month operating system patching for workstations, non-internet-facing servers and network devicesPartially meets
This control partially meets E8-PO-ML1.7.
E8-PO-ML1.7 requires all operating system patches for workstations, non-internet-facing servers and non-internet-facing network devices to be applied within one month of release, while ISM-1902 sets the same one-month deadline for the same systems only where vendors assess the vulnerability as non-critical and no working exploit exists. ISM-1902 is therefore a subset of E8-PO-ML1.7, and meeting E8-PO-ML1.7 meets it.
This control partially overlaps E8-PO-ML1.5.
ISM-1902 requires organisations to apply non-critical operating system patches to non-internet-facing systems within one month when no working exploits exist. E8-PO-ML1.5 relates by addressing OS patching for internet-facing servers and network devices but is triggered by critical vendor ratings or working exploits and requires patching within 48 hours. They overlap in managing OS vulnerabilities through prompt patching but differ in system exposure (internet-facing vs non-internet-facing) and severity/time requirements.
- E8-PO-ML1.6Timely application of non-critical patches for internet-facing OS vulnerabilitiesPartially overlaps
This control partially overlaps E8-PO-ML1.6.
E8-PO-ML1.6 requires non-critical OS patches for internet-facing servers and internet-facing network devices to be applied within two weeks when no working exploits exist. ISM-1902 addresses the same patching concept and conditions (non-critical, no working exploits) but applies it to workstations and non-internet-facing servers/devices with a different timeframe (one month). They overlap on patch management intent for OS vulnerabilities, but differ materially on asset exposure (internet-facing vs not) and required speed.
This control partially overlaps E8-PO-ML3.3.
ISM-1902 requires organisations to apply non-critical operating system patches to non-internet-facing systems within one month when no working exploits exist. E8-PO-ML3.3 relates by covering the same asset classes (workstations, non-internet-facing servers and network devices) but focuses on critical vulnerabilities or those with working exploits and mandates patching within 48 hours. They overlap on the shared objective of timely OS vulnerability mitigation for non-internet-facing systems, but differ on severity/trigger conditions and timeframes.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.