ASD ISM 2118 Conduct vulnerability assessments and penetration tests
What it says
Vulnerability assessments and penetration tests are conducted for systems prior to their deployment, including prior to the deployment of significant changes, and at least every six months thereafter.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishVulnerability assessments and penetration tests are conducted before systems are deployed, before significant changes are deployed, and at least every six months thereafter.
This control is about testing systems for security weaknesses before you roll them out, before you deploy any big changes, and then at least every six months. It helps catch vulnerabilities before someone else does, keeping systems and data safe. If you skip these checks, attackers might find and exploit weaknesses, causing data breaches or disruptions.
Free. Save your status, tasks and notes.
Why it matters
If this control is not followed, systems may go live with unaddressed security flaws, leaving them open to cyber attacks. Attackers could exploit these weaknesses to steal data, disrupt services, or damage your reputation, possibly resulting in regulatory penalties and loss of customer trust.
How to implement
Before launching a new system, conduct a comprehensive vulnerability assessment using an automated vulnerability scanning tool.
Have knowledgeable personnel run the scan to identify security defects.
For penetration tests, simulate attacks on your system to test its defences.
Engage a certified ethical hacker or a security consultant to conduct these tests in a controlled manner before any new deployment.
Whenever significant changes are planned for existing systems, schedule a vulnerability assessment and penetration test to be completed before the change is deployed.
Use project change logs to identify updates that would trigger these checks.
Establish a routine schedule to ensure that vulnerability assessments and penetration tests are performed at least every six months.
Use reminders in project management tools to alert IT security staff when these tests are due.
Develop a process for documenting and tracking vulnerabilities and penetration test results.
Ensure there is a system in place for prioritising and addressing identified issues, and record remediation actions taken.
Keep it running
Regularly update the tools and techniques used for vulnerability assessments and penetration tests to reflect evolving threats. Ensure all significant system changes trigger a vulnerability assessment and penetration test before the change is deployed to maintain security integrity. Foster an organisational culture where security testing is a routine part of system management, not an afterthought.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request documentation for vulnerability assessments conducted before system deployment and before the deployment of significant changes.
Look at
Ensure the documentation includes detailed scan reports showing the date and scope of the assessments.
Good evidence
Reports clearly show vulnerabilities identified, with assessment dates falling before deployment and before significant changes were deployed, and remediation actions logged.
- Check 2 of 5What an auditor asks for
Ask for
Ask for records of penetration test activities conducted prior to deployment and significant system changes.
Look at
Review the test reports to confirm they include objectives, methodologies used, findings, and any corrective actions.
Good evidence
A comprehensive report that outlines testing procedures, discovered vulnerabilities, and steps taken to mitigate them.
- Check 3 of 5What an auditor asks for
Ask for
Request the scheduling register for vulnerability assessments and penetration tests.
Look at
Check scheduled dates against the requirement for six-monthly testing and pre-deployment/major changes.
Good evidence
A log showing a consistent pattern of assessments conducted on schedule, including tests completed before major changes were deployed.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the change management records for recent significant changes to in-scope systems.
Look at
Cross-check the deployment date of each significant change against the dates of the corresponding vulnerability assessment and penetration test reports.
Good evidence
Every significant change has a vulnerability assessment and penetration test report dated before the change went live.
- Check 5 of 5What an auditor asks for
Ask for
Request the vulnerability assessment and penetration test reports for the last twelve months for a sample of deployed systems.
Look at
Check the interval between consecutive assessments and tests for each system in the sample.
Good evidence
No system in the sample shows a gap of more than six months between successive vulnerability assessments and penetration tests.
Mappings
Closest match in ASD Essential Eight: E8-PA-ML2.1, Fortnightly vulnerability scanning for non-core applications, which this control covers in full and more.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-2118 requires organisations to conduct vulnerability assessments and penetration tests prior to deployment/significant changes and at least every six months. Annex A 8.8 requires ongoing management of technical vulnerabilities, including obtaining vulnerability information, evaluating exposure, and taking appropriate measures. ISM-2118 is a specific testing-focused implementation within the broader ISO requirement, which also covers identification, evaluation, and remediation governance beyond testing cadence.
ASD Essential Eight: 2 mappings
This control is broader than E8-PA-ML2.1.
ISM-2118 requires vulnerability assessments and penetration tests before deployment (and significant changes) and at least every six months thereafter. E8-PA-ML2.1 specifies a recurring vulnerability scanning cadence (fortnightly) for non-core applications, which is one method of vulnerability assessment that can contribute evidence for ISM-2118. ISM-2118 is broader because it also includes penetration testing and explicit pre-deployment testing requirements, not just periodic scanning for missing patches.
This control is broader than E8-PO-ML1.1.
ISM-2118 requires vulnerability assessments and penetration tests to be performed before deployment and periodically thereafter. E8-PO-ML1.1 requires automated fortnightly asset discovery to support subsequent vulnerability scanning, which helps ensure the testing/scanning coverage expected by ISM-2118 is not missing unmanaged assets. E8-PO-ML1.1 is narrower because it is an enabling activity (asset discovery) and does not itself require vulnerability assessment or penetration testing.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.