PRO-06 Vulnerability management

five actionsAlso in ASD Essentials for enterprise IT

Where it suits your needs, favour services in which the provider handles more of the security. Find and fix weaknesses in what you add or manage within risk-based timeframes, and check that fixes worked. Test patches first and keep tested rollback or recovery steps.

Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026

The principle

Vulnerabilities in systems (infrastructure, operating systems, applications and data) are identified, documented, validated and prioritised for remediation or mitigation in a timely manner, with all remediation and mitigation actions verified for effectiveness.

ASD, Information Security Manual (ISM), Principle PRO-06

The five actions

ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.

C: Customer
S: Supplied
P: Provider-inherited

Action 1 of 5
Prioritise cloud services that maximise provider-managed security responsibilities and minimise customer-managed components, where this is consistent with organisational, security and business requirements.
In plain English: Favour cloud services where the provider does the most security work and you manage the fewest parts. Do this where it fits your organisational, security and business needs.
Domains
Governance and culture
Who does it
PaaSCustomer
SaaSCustomer
Action 2 of 5
Identify, prioritise and remediate vulnerabilities in customer-introduced applications, integrations and extensions within risk-based timeframes.
In plain English: Find, rank and fix vulnerabilities (security weaknesses) in the apps, integrations and extensions you add to your cloud services. Do this within timeframes based on risk.
Domains
Identity services
Boundary services
Critical processes and services
Privileged environments
Business systems
User devices
Who does it
PaaSCustomer
SaaSCustomer
MITRE ATT&CK
Exploit Public-Facing Application
Exploitation for Privilege Escalation
Action 3 of 5
Apply security patches or updates to customer-managed components within defined risk-based timeframes, or automatically where impact is low.
In plain English: Apply security patches or updates to the parts you manage within set timeframes based on risk. Where the impact is low, you can apply them automatically instead.
Domains
Identity services
Boundary services
Critical processes and services
Privileged environments
Business systems
Who does it
PaaSCustomer
SaaSCustomer
MITRE ATT&CK
Exploit Public-Facing Application
Exploitation for Privilege Escalation
Action 4 of 5
Remediate or mitigate vulnerabilities exceeding defined risk thresholds within defined risk-based timeframes based on exploitation, exposure, criticality, impact and compensating controls and verify treatment effectiveness.
In plain English: Within set timeframes, fix or reduce vulnerabilities above your risk thresholds and check this worked. Base timeframes on exploitation, exposure, criticality, impact and compensating controls (other safeguards).
Domains
Identity services
Boundary services
Critical processes and services
Privileged environments
Business systems
Who does it
PaaSSupplied
SaaSProvider-inherited
MITRE ATT&CK
Exploit Public-Facing Application
Exploitation for Privilege Escalation
Action 5 of 5
Test security patches and updates before deployment and maintain tested rollback or recovery procedures to manage adverse operational impacts.
In plain English: Test security patches and updates before you deploy them. Keep tested rollback or recovery procedures in case they disrupt operations.
Domains
Identity services
Boundary services
Critical processes and services
Privileged environments
Business systems
Who does it
PaaSCustomer
SaaSProvider-inherited
MITRE ATT&CK
Exploit Public-Facing Application
Exploitation for Privilege Escalation