What does ASD ISM 1902 require?

policyASD Information Security Manual (ISM)

ASD ISM 1902Apply Non-Critical Patches to Non-Internet Systems Promptly

Official control statement

Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.

policyASD Information Security Manual (ISM)ISM-1902

Quoted as published. Everything else on this page is written by Control Stack.

In plain English

Ensure non-critical security patches are applied within a month if no active threats are identified.

ML3 NC OS PASD Information Security ManualGuidelines for system management

Control Stack classificationPreventative Patch management

record_voice_over

What this means in practice

This control is about making sure that all non-critical updates for software on internal systems are applied within a month. It's crucial because if these updates aren't applied, even minor vulnerabilities can be exploited by cybercriminals, leading to data breaches or system downtime.

01 - Overview

Framework

ASD Information Security Manual (ISM)

Control effect (Control Stack)

Preventative

Classifications

NC, OS, P, S, TS

ISM last updated

Dec 2023

Control Stack last updated

29 Sept 2026

E8 maturity levels

ML3

Guideline

Guidelines for system management

Section

System maintenance

Topic

Mitigating known vulnerabilities

priority_high

Why it matters

Delaying vendor-rated non-critical patches on non-internet systems can allow internal attackers to exploit known flaws, escalating access and impacting integrity.

settings

Operational notes

Track vendor releases and apply non-critical OS patches to non-internet-facing workstations, servers and network devices within 30 days where no working exploits exist.

02 - Implement

build

Implementation tips

The IT team should maintain a clear schedule for applying non-critical patches. To do this, they can use a spreadsheet or a software tool to track when each patch is released and ensure it gets applied within 30 days.
System administrators should regularly check vendor websites for patch updates. They can subscribe to email alerts or use automated tools to receive notifications when new security patches are released.
Managers should ensure that there is enough IT support available to review and apply patches. This can be done by assessing team workloads and adjusting resources, so patch applications don't get delayed.
System owners should communicate with vendors if they face issues applying a patch. They can do this by calling vendor support hotlines or using online help forums provided by the vendors.
Office managers should have a monthly meeting with the IT team to go over the patching status. During this meeting, they should check any pending patches, discuss any problems encountered, and plan for future patching needs.

03 - Audit

fact_check

Audit / evidence tips

AskA patch management schedule: Request to see documentation showing when patches are planned to be appliedLook atRegular entries within the schedule indicating patches are applied within a monthGoodIncludes a consistently updated schedule demonstrating patch timelines
AskPatch deployment logs: Request logs that show when patches were actually applied to systemsLook atThe dates in these logs to verify they match the planned timelines. Good evidence is logs showing all non-critical patches applied within the one-month window
AskVendor communication records: Request any communications with vendors regarding patch issues or updatesLook atProactive discussions and resolution outcomesGoodSign is timely responses and resolved issues related to patching successfully documented
AskRecords of IT meetings: Request minutes or notes from meetings where patching was discussedLook atMentions of upcoming patches, deployment timelines, and any identified risksGoodExample would be structured meeting records noting patch priorities and actions
AskTraining material or records: Request documentation or records showing the training system administrators receive regarding update processesLook atThe date and relevance of the material provided. Good evidence includes up-to-date training sessions that highlight the importance and process of timely patching

04 - Mappings

link

Cross-framework mappings

How ISM-1902 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.

E8

Control	Notes	Details
equalEquivalent(1)expand_less
E8-PO-ML3.4	E8-PO-ML3.4 requires patches, updates or vendor mitigations for non-critical OS vulnerabilities (with no working exploits) to be applied ...
sync_altPartially overlaps(3)expand_less
E8-PO-ML1.5	ISM-1902 requires organisations to apply non-critical operating system patches to non-internet-facing systems within one month when no wo...
E8-PO-ML1.6	E8-PO-ML1.6 requires non-critical OS patches for internet-facing servers and internet-facing network devices to be applied within two wee...
E8-PO-ML3.3	ISM-1902 requires organisations to apply non-critical operating system patches to non-internet-facing systems within one month when no wo...