Patch applications

search account_circle

boltEssential 8

Patch applications

13 controls in this part of theEssential Eight. Each control links to plain-English guidance, audit tips and cross-framework mappings.

Automated asset discovery at least fortnightly

Use automated tools every two weeks to find all devices for security checks.

Up-to-date vulnerability scanner used for scanning activities

Use a current vulnerability scanner to check for security issues in your apps.

Daily vulnerability scanning for missing patches in online services

Use a daily scanner to find missing security updates for online services.

Weekly scanning for missing patches or updates in key software

Use a tool every week to check and update key software like browsers and office apps to fix security

Apply critical application patches within 48 hours

Ensure critical software updates are installed within 48 hours to prevent security risks.

Apply non-critical patches for online services within two weeks

Install updates for online services within two weeks if not critical and no exploits exist.

Unsupported online services are removed by the organisation

Remove online services that the vendor no longer supports to enhance security.

Removal of unsupported software and applications

Remove office, browser, and security software that is no longer supported by the vendor.

Fortnightly vulnerability scanning for non-core applications

Use a vulnerability scanner every two weeks to find missing patches in non-core applications.

Timely Patching of Non-Critical Application Vulnerabilities

Apply patches for non-critical apps within a month to fix vulnerabilities.

Patch critical vulnerabilities in applications within 48 hours

Apply critical patches to important software within 48 hours of release.

Apply patches for non-critical vulnerabilities within two weeks

Ensure software patches for non-critical flaws are installed within two weeks if no exploits exist.

Remove unsupported applications excluding certain categories

Ensure unsupported non-critical applications are removed for security.

Back to the full ASD Essential Eight control list, or browse the complete control library.