PRO-06 · Protect

Vulnerability management

Vulnerabilities in systems (infrastructure, operating systems, applications and data) are identified, documented, validated and prioritised for remediation or mitigation in a timely manner, with all remediation and mitigation actions verified for effectiveness.

Enterprise IT actions

• IT.PRO-06.1

  Identify known software and configuration weaknesses of assets through continuous and repeatable assessment activities, including vulnerability scanning activities.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  ASD’s indicators

  Not effective

  • Vulnerability scanning activities are not undertaken.
  • No routine vulnerability assessment activity has been conducted within a period defined by the organisation.
  • Advisories for relevant software and configuration weaknesses for organisational assets are not reviewed and assessed for impact.

  Partially effective

  • Vulnerability scanning is deployed but does not cover all applicable assets.
  • Vulnerability scans are conducted but results are not reviewed and prioritised within timeframes defined by the organisation.
  • Vulnerability scans are conducted but frequency is not regular enough to enable timely response.
  • Scanning covers software vulnerabilities but not configuration weaknesses.
  • Advisories for relevant software and configuration weaknesses for organisational assets are reviewed on an ad hoc basis, or only for some assets.

  Fully effective

  • All applicable assets are included in routine vulnerability scanning, and scanning frequency enables timely response.
  • Scanning covers both software vulnerabilities and configuration weaknesses.
  • Results are reviewed and prioritised within timeframes defined by the organisation.
  • Advisories for relevant software and configuration weaknesses in all organisational assets are regularly reviewed and assessed for impact.
  Related frameworks

  NIST CSF 2.0

  ID.RA-01, ID.RA-05, DE.CM-09

  NIST SP 800-171r3

  03.11.02, 03.12.03, 03.14.01

  AESCSF v2

  THREAT-1c, THREAT-1f, THREAT-1b

  Essential Eight

  Patch applications, Patch operating systems

  MITRE ATT&CK

  T1190 Exploit Public-Facing Application, T1068 Exploitation for Privilege Escalation, T1210 Exploitation of Remote Services, T1203 Exploitation for Client Execution

  Rate this action in the Navigator →
• IT.PRO-06.2

  Apply security patches or updates within defined risk-based timeframes or automatically where operational impact is low.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  ASD’s indicators

  Not effective

  • No defined patching timeframes exist for applicable assets.
  • Patches are not applied or are applied on an ad hoc basis with no tracking.

  Partially effective

  • Expected patching timeframes are defined by the organisation but are not consistently met.
  • Patches are applied but compensating controls are not documented where operational constraints prevent timely patching.
  • Patching coverage metrics exist but show significant gaps.

  Fully effective

  • Risk-based patching timeframes defined by the organisation are in place and consistently met.
  • Patching is prioritised based on vulnerability severity, exposure and exploit availability.
  • Where operational constraints prevent timely patching, compensating controls are documented and approved.
  • Patching coverage metrics account for all applicable assets, with any exclusions identified and formally risk accepted.
  • Automatic patching of assets is applied where available and the organisation has determined operational impact is low.
  Related frameworks

  ISM

  ISM-0298, ISM-1143

  NIST CSF 2.0

  ID.RA-01, PR.PS-02, PR.PS-03, RS.MA-04

  NIST SP 800-171r3

  03.14.01, 03.14.03, 03.04.03

  AESCSF v2

  THREAT-1d, THREAT-1h, ASSET-4e

  Essential Eight

  Patch applications, Patch operating systems

  MITRE ATT&CK

  T1190 Exploit Public-Facing Application, T1068 Exploitation for Privilege Escalation, T1210 Exploitation of Remote Services, T1203 Exploitation for Client Execution

  Rate this action in the Navigator →
• IT.PRO-06.3

  Remediate or mitigate vulnerabilities exceeding defined risk thresholds within defined timeframes based on exploitation, exposure, criticality, impact and compensating controls, and verify treatment effectiveness.

  • Phase 1Boundary services, Identity services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  ASD’s indicators

  Not effective

  • No risk thresholds are defined for vulnerability remediation.
  • Vulnerabilities exceeding acceptable risk levels are not tracked or remediated.

  Partially effective

  • Risk thresholds are defined but vulnerabilities exceeding them are not consistently remediated within defined timeframes.
  • Compensating controls are applied in some cases but are not formally documented or approved.

  Fully effective

  • Risk thresholds defined by the organisation exist, and vulnerabilities exceeding them are remediated or have approved compensating controls within organisationally defined timeframes.
  • Remediation and mitigation actions are tracked to closure with verification that actions reduced the risk as intended.
  • The process is sustained, with historical data demonstrating consistent performance across organisationally defined reporting periods.
  Related frameworks

  ISM

  ISM-1809, ISM-1921

  NIST CSF 2.0

  ID.RA-01, ID.RA-05, GV.RM-06

  NIST SP 800-171r3

  03.11.02, 03.11.04, 03.14.01, 03.12.02

  AESCSF v2

  THREAT-1d, THREAT-1g, THREAT-1l, RISK-2i

  Essential Eight

  Patch applications, Patch operating systems

  MITRE ATT&CK

  T1190 Exploit Public-Facing Application, T1068 Exploitation for Privilege Escalation, T1210 Exploitation of Remote Services, T1203 Exploitation for Client Execution

  Rate this action in the Navigator →

Operational technology actions

• Action 1

  Apply security patches or updates within defined risk-based timeframes, record each asset that cannot or will not be patched along with the reason, and bring critical OT elements that can be updated to the same hardening baseline as equivalent critical elements in IT.

  • Phase 1Boundary services, Critical processes and services
  • Phase 2Privileged environments, Identity services
  • Phase 3Business systems
  Rate this action in the Navigator →
• Action 2

  Apply compensating protections where assets cannot or will not be patched, or where they remain operationally critical but are no longer supported by security patch release.

  • Phase 1Boundary services, Critical processes and services
  • Phase 2Privileged environments, Identity services
  • Phase 3Business systems
  Rate this action in the Navigator →
• Action 3

  Establish and maintain a register of assets that cannot be patched, or that will not be patched, recording for each the reason, the compensating protections applied, the residual risk accepted and the authority accepting it, and review each entry at defined cadence whenever the asset's exposure changes.

  • Phase 1Boundary services, Critical processes and services
  • Phase 2Privileged environments, Identity services
  • Phase 3Business systems
  Rate this action in the Navigator →

Cloud actions

• Action 1

  Prioritise cloud services that maximise provider-managed security responsibilities and minimise customer-managed components, where this is consistent with organisational, security and business requirements.

  • Every phaseGovernance and culture
  • ResponsibilityPaaS: Customer, SaaS: Customer
  Rate this action in the Navigator →
• Action 2

  Identify, prioritise and remediate vulnerabilities in customer-introduced applications, integrations and extensions within risk-based timeframes.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems, User devices
  • ResponsibilityPaaS: Customer, SaaS: Customer
  Rate this action in the Navigator →
• Action 3

  Apply security patches or updates to customer-managed components within defined risk-based timeframes, or automatically where impact is low.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems
  • ResponsibilityPaaS: Customer, SaaS: Customer
  Rate this action in the Navigator →
• Action 4

  Remediate or mitigate vulnerabilities exceeding defined risk thresholds within defined risk-based timeframes based on exploitation, exposure, criticality, impact and compensating controls and verify treatment effectiveness.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems
  • ResponsibilityPaaS: Supplied, SaaS: Provider
  Rate this action in the Navigator →
• Action 5

  Test security patches and updates before deployment and maintain tested rollback or recovery procedures to manage adverse operational impacts.

  • Phase 1Identity services, Boundary services
  • Phase 2Critical processes and services, Privileged environments
  • Phase 3Business systems
  • ResponsibilityPaaS: Customer, SaaS: Provider
  Rate this action in the Navigator →

Open the Navigator →

More Protect principles

• PRO-01Secure system lifecycle
• PRO-04Secure configuration management
• PRO-05Secure administration
• PRO-07Trustworthy software
• PRO-08Cryptographic protection
• PRO-09Content filtering
• PRO-10Regular and proven backups
• PRO-12Least privilege access
• PRO-13Identity, credential and access management
• PRO-14Cyber security awareness training
• PRO-15Physical access control
• PRO-16Cyber supply chain security
• PRO-18Network segmentation and segregation
• PRO-19Operational technology isolation
• PRO-20Remote access to operational technology

Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.