Essential Eight · strategy 1 of 8
Patch applications
Find and patch security vulnerabilities in applications, on deadlines that tighten at each level, and remove applications their vendors no longer support. The tables list the ISM controls ASD tags for this strategy at each maturity level; a level is reached only when every requirement at that level and below is met.
Patch applications · Patch operating systems · Multi-factor authentication · Restrict administrative privileges · Application control · Restrict Microsoft Office macros · User application hardening · Regular backups
Maturity Level One · 9 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-1690 | Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist. | ML1, ML2, ML3 | — |
| ISM-1691 | Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release. | ML1, ML2 | A.8.8 CC7.1 PR.PS-02 |
| ISM-1698 | A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services. | ML1, ML2, ML3 | A.8.8 CC7.1 ID.RA-01 |
| ISM-1699 | A vulnerability scanner is used at least weekly to identify missing patches or updates for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products. | ML1, ML2, ML3 | A.8.8 CC7.1 ID.RA-01 |
| ISM-1704 | Office productivity suites, web browsers and their extensions, email clients, PDF applications, Adobe Flash Player, and security products that are no longer supported by vendors are removed. | ML1, ML2, ML3 | A.8.8 CC7.1 PR.PS-02 |
| ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities. | ML1, ML2, ML3 | A.5.9 CC6.1 ID.AM-01 |
| ISM-1808 | A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities. | ML1, ML2, ML3 | A.8.8 CC7.1 ID.RA-01 |
| ISM-1876 | Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist. | ML1, ML2, ML3 | A.8.8 CC7.1 PR.PS-02 |
| ISM-1905 | Online services that are no longer supported by vendors are removed. | ML1, ML2, ML3 | — |
Maturity Level Two · 11 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-1690 | Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist. | ML1, ML2, ML3 | — |
| ISM-1691 | Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release. | ML1, ML2 | A.8.8 CC7.1 PR.PS-02 |
| ISM-1693 | Patches, updates or other vendor mitigations for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within one month of release. | ML2, ML3 | A.8.8 CC7.1 PR.PS-02 |
| ISM-1698 | A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services. | ML1, ML2, ML3 | A.8.8 CC7.1 ID.RA-01 |
| ISM-1699 | A vulnerability scanner is used at least weekly to identify missing patches or updates for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products. | ML1, ML2, ML3 | A.8.8 CC7.1 ID.RA-01 |
| ISM-1700 | A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products. | ML2, ML3 | — |
| ISM-1704 | Office productivity suites, web browsers and their extensions, email clients, PDF applications, Adobe Flash Player, and security products that are no longer supported by vendors are removed. | ML1, ML2, ML3 | A.8.8 CC7.1 PR.PS-02 |
| ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities. | ML1, ML2, ML3 | A.5.9 CC6.1 ID.AM-01 |
| ISM-1808 | A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities. | ML1, ML2, ML3 | A.8.8 CC7.1 ID.RA-01 |
| ISM-1876 | Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist. | ML1, ML2, ML3 | A.8.8 CC7.1 PR.PS-02 |
| ISM-1905 | Online services that are no longer supported by vendors are removed. | ML1, ML2, ML3 | — |
Maturity Level Three · 13 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-0304 | Applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, Adobe Flash Player, and security products that are no longer supported by vendors are removed. | ML3 | — |
| ISM-1690 | Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist. | ML1, ML2, ML3 | — |
| ISM-1692 | Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist. | ML3 | — |
| ISM-1693 | Patches, updates or other vendor mitigations for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within one month of release. | ML2, ML3 | A.8.8 CC7.1 PR.PS-02 |
| ISM-1698 | A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in online services. | ML1, ML2, ML3 | A.8.8 CC7.1 ID.RA-01 |
| ISM-1699 | A vulnerability scanner is used at least weekly to identify missing patches or updates for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products. | ML1, ML2, ML3 | A.8.8 CC7.1 ID.RA-01 |
| ISM-1700 | A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products. | ML2, ML3 | — |
| ISM-1704 | Office productivity suites, web browsers and their extensions, email clients, PDF applications, Adobe Flash Player, and security products that are no longer supported by vendors are removed. | ML1, ML2, ML3 | A.8.8 CC7.1 PR.PS-02 |
| ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities. | ML1, ML2, ML3 | A.5.9 CC6.1 ID.AM-01 |
| ISM-1808 | A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities. | ML1, ML2, ML3 | A.8.8 CC7.1 ID.RA-01 |
| ISM-1876 | Patches, updates or other vendor mitigations for vulnerabilities in online services are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist. | ML1, ML2, ML3 | A.8.8 CC7.1 PR.PS-02 |
| ISM-1901 | Patches, updates or other vendor mitigations for vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF applications, and security products are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist. | ML3 | — |
| ISM-1905 | Online services that are no longer supported by vendors are removed. | ML1, ML2, ML3 | — |
Applies to every strategy
Logging and incident controls that ASD repeats under each strategy.
ML2: ISM-0123 ISM-0140 ISM-1228 ISM-1815 ISM-1819 ISM-1906
ML3: ISM-0109 ISM-0123 ISM-0140 ISM-1228 ISM-1815 ISM-1819 ISM-1906 ISM-1907
Control text: Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0. Links to other frameworks are ControlMapping editorial (ASD publishes no crosswalk). Essential Eight guide · Gap analysis → Essential Eight