ISM-1877 · September 2026
Mitigating known vulnerabilities
Guidelines for system management / System maintenance / Mitigating known vulnerabilities
Official control wording
Patches, updates or other vendor mitigations for vulnerabilities in operating systems of internet-facing servers and internet-facing network devices are applied within 48 hours of release when vulnerabilities are assessed as critical by vendors or when working exploits exist.
Applicability
These are ASD’s applicability markings. Select and tailor controls for your system’s risk, classification and operating context with the system owner and authorising officer.
ASD Essential Eight applicability: ML1 · ML2 · ML3. A profile marking does not establish maturity attainment.
// Latticework implementation guidance · partial coverage
Track support and patch evidence for every operating-system layer
Practical suggestions for a Kubernetes or cloud system. Adapt these steps to your architecture and approved system boundary.
Implementation steps
- Inventory container base images, node operating systems and internet-facing network devices separately. Assign owners and record vendor support dates.
- Use the mapped policies to review declared base-image metadata. Drive patch decisions from actual vendor advisories and vulnerability findings, then rebuild, deploy and verify the affected components within the applicable control deadline.
Evidence to retain
- Keep the component inventory, vendor advisory and release date, severity/exploit assessment, patch decision and deployment verification timestamps.
- Retain image labels and PolicyReports as supporting metadata. Add node and device patch records; labels do not verify installed patches or support state.
What the mapped checks can establish
Container base-image support metadata is supporting evidence only; criticality, exploit status and node or network-device patch timing remain external.
Responsibility boundary
Platform team: node and device lifecycle. Workload/pipeline team: supported base images and rebuilt artefacts. Organisation: patch policy, deadlines and approved exceptions.
The public mapping’s detector allocation is provisional for both managed and self-managed clusters. Agree the responsibility matrix for the engagement; provider inheritance and whole-control ownership require a reviewed system boundary and applicable customer/provider evidence.
Mapped checks to inspect
- kyverno: ism-patch-operating-systems-block-eol-base-images
- kyverno: ism-patch-operating-systems-require-base-image-label
These identifiers are from the pinned public mapping. Kyverno mappings describe the policy configuration you must inspect; they do not mean a policy is installed or enforcing. A manifest scan cannot establish live runtime behaviour. Record the exact tool, policy and framework versions, settings, exclusions and execution time with each result.
Review the mapping and control-specific limitations at revision 07b348a. Supporting mapping excerpts (checks, evidence notes and responsibility allocations) are adapted from Latticework Systems’ public repository under Apache-2.0. ASD’s control wording stays under CC BY 4.0.
Official source
ASD’s ISM OSCAL v2026.09.4 · Original catalogue JSON · Pinned checksums and edition details
Control source identifier: ism-1877. Check the official release before relying on this snapshot for an assessment.
Official control wording and applicability: Australian Signals Directorate, © Commonwealth of Australia 2026. September 2026 ISM, OSCAL v2026.09.4, reproduced under CC BY 4.0. Formatting is adapted for this website.
Latticework Systems’ implementation guidance is our interpretation. Provenance and scope.