PRO-06 Vulnerability management
3 actions under this Protect principle in ASD Essentials for enterprise IT. Each action links to plain-English guidance, audit tips and cross-framework mappings.
ASD principle statement
Vulnerabilities in systems (infrastructure, operating systems, applications and data) are identified, documented, validated and prioritised for remediation or mitigation in a timely manner, with all remediation and mitigation actions verified for effectiveness.
Quoted as published. Everything else on this page is written by Control Stack.
The three actions
- IT.PRO-06.1Continuously Scan and Assess Assets for Known Software and Configuration Weaknesses
Finds known software flaws and weak settings on all systems through ongoing, repeatable checks, including vulnerability scans and reviews of security advisories.
Domains:All six technical domains (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices) - IT.PRO-06.2Apply Security Patches Within Risk-Based Timeframes and Automate Low-Impact Updates
Applies security patches and updates within set deadlines based on risk, or automatically where the impact on operations is low.
Domains:All six technical domains (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices) - IT.PRO-06.3Remediate or Mitigate Above-Threshold Vulnerabilities Within Defined Timeframes and Verify Effectiveness
Fixes security weaknesses rated above the organisation's risk limit, or adds safeguards, by risk-based deadlines, then checks the risk really dropped.
Domains:All six technical domains (Boundary services, Identity services, Critical processes and services, Privileged environments, Business systems, User devices)
Back to the full Essentials for enterprise IT action list, or browse the complete control library.