Australian Information Security Manual ISM-1904: Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied w

Patches, updates or other vendor mitigations for vulnerabilities in firmware are applied within one month of release when vulnerabilities are assessed as non-critical by vendors and no working exploits exist.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Guidelines for system management

ISM-0042 System administration processes, and supporting system administration procedures, are deve
ISM-0298 A centralised and managed approach that maintains the integrity of patches or updates, and
ISM-0300 Patches, updates or other vendor mitigations for vulnerabilities in high assurance IT equi
ISM-0304 Applications other than office productivity suites, web browsers and their extensions, ema
ISM-1143 Patch management processes, and supporting patch management procedures, are developed, imp
ISM-1211 System administrators perform system administration activities in accordance with the syst
ISM-1380 Privileged users use separate privileged and unprivileged operating environments.
ISM-1385 Administrative infrastructure is segregated from the wider network and the internet.

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Australian Information Security Manual controls