Australian Information Security Manual ISM-0300: Patching high assurance IT equipment

Patches, updates or other vendor mitigations for vulnerabilities in high assurance IT equipment are applied only when approved by ASD, and in doing so, using methods and timeframes prescribed by ASD.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Guidelines for system management

ISM-0042 System administration processes and procedures
ISM-0298 Centralised and managed patching
ISM-0304 Removing unsupported applications
ISM-1143 Patch management processes and procedures
ISM-1211 Administration under change and configuration management
ISM-1380 Separate privileged operating environments
ISM-1385 Segregation of administrative infrastructure
ISM-1386 Management traffic sourced from administrative infrastructure

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Australian Information Security Manual controls