Essential Eight · strategy 2 of 8
Patch operating systems
The same for operating systems, and at higher levels drivers and firmware: scan for missing patches, apply them on deadline, and replace unsupported versions. The tables list the ISM controls ASD tags for this strategy at each maturity level; a level is reached only when every requirement at that level and below is met.
Patch applications · Patch operating systems · Multi-factor authentication · Restrict administrative privileges · Application control · Restrict Microsoft Office macros · User application hardening · Regular backups
Maturity Level One · 8 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-1501 | Operating systems that are no longer supported by vendors are replaced. | ML1, ML2, ML3 | A.8.8 CC7.1 PR.PS-02 |
| ISM-1694 | Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist. | ML1, ML2, ML3 | — |
| ISM-1695 | Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release. | ML1, ML2 | A.8.8 CC7.1 PR.PS-02 |
| ISM-1701 | A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices. | ML1, ML2, ML3 | A.8.8 CC7.1 ID.RA-01 |
| ISM-1702 | A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices. | ML1, ML2, ML3 | A.8.8 CC7.1 ID.RA-01 |
| ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities. | ML1, ML2, ML3 | A.5.9 CC6.1 ID.AM-01 |
| ISM-1808 | A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities. | ML1, ML2, ML3 | A.8.8 CC7.1 ID.RA-01 |
| ISM-1877 | Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist. | ML1, ML2, ML3 | A.8.8 CC7.1 PR.PS-02 |
Maturity Level Two · 8 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-1501 | Operating systems that are no longer supported by vendors are replaced. | ML1, ML2, ML3 | A.8.8 CC7.1 PR.PS-02 |
| ISM-1694 | Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist. | ML1, ML2, ML3 | — |
| ISM-1695 | Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release. | ML1, ML2 | A.8.8 CC7.1 PR.PS-02 |
| ISM-1701 | A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices. | ML1, ML2, ML3 | A.8.8 CC7.1 ID.RA-01 |
| ISM-1702 | A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices. | ML1, ML2, ML3 | A.8.8 CC7.1 ID.RA-01 |
| ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities. | ML1, ML2, ML3 | A.5.9 CC6.1 ID.AM-01 |
| ISM-1808 | A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities. | ML1, ML2, ML3 | A.8.8 CC7.1 ID.RA-01 |
| ISM-1877 | Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist. | ML1, ML2, ML3 | A.8.8 CC7.1 PR.PS-02 |
Maturity Level Three · 16 controls
| ISM control | Requirement (ASD's text) | Levels | Mapped to (ISO 27001, SOC 2, NIST CSF) |
|---|---|---|---|
| ISM-1407 | The latest release, or the previous release, of operating systems are used. | ML3 | — |
| ISM-1501 | Operating systems that are no longer supported by vendors are replaced. | ML1, ML2, ML3 | A.8.8 CC7.1 PR.PS-02 |
| ISM-1694 | Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within two weeks of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist. | ML1, ML2, ML3 | — |
| ISM-1696 | Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist. | ML3 | — |
| ISM-1697 | Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist. | ML3 | — |
| ISM-1701 | A vulnerability scanner is used at least daily to identify missing patches or updates for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices. | ML1, ML2, ML3 | A.8.8 CC7.1 ID.RA-01 |
| ISM-1702 | A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices. | ML1, ML2, ML3 | A.8.8 CC7.1 ID.RA-01 |
| ISM-1703 | A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in drivers. | ML3 | — |
| ISM-1807 | An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities. | ML1, ML2, ML3 | A.5.9 CC6.1 ID.AM-01 |
| ISM-1808 | A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities. | ML1, ML2, ML3 | A.8.8 CC7.1 ID.RA-01 |
| ISM-1877 | Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist. | ML1, ML2, ML3 | A.8.8 CC7.1 PR.PS-02 |
| ISM-1879 | Patches, updates or other vendor mitigations for vulnerabilities in drivers are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist. | ML3 | — |
| ISM-1900 | A vulnerability scanner is used at least fortnightly to identify missing patches or updates for vulnerabilities in firmware. | ML3 | — |
| ISM-1902 | Patches, updates or other vendor mitigations for vulnerabilities in operating systems of workstations, non-internet-facing servers and non-internet-facing network devices are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist. | ML3 | — |
| ISM-1903 | Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist. | ML3 | — |
| ISM-1904 | Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist. | ML3 | — |
Applies to every strategy
Logging and incident controls that ASD repeats under each strategy.
ML2: ISM-0123 ISM-0140 ISM-1228 ISM-1815 ISM-1819 ISM-1906
ML3: ISM-0109 ISM-0123 ISM-0140 ISM-1228 ISM-1815 ISM-1819 ISM-1906 ISM-1907
Control text: Australian Signals Directorate, Information Security Manual (September 2026). © Commonwealth of Australia, CC BY 4.0. Links to other frameworks are ControlMapping editorial (ASD publishes no crosswalk). Essential Eight guide · Gap analysis → Essential Eight