Control: ism-1694; Revision: 0; Updated: Sep-21; Applicability: ALL; Essential Eight: ML3 ​

Patches, updates or vendor mitigations for security vulnerabilities in operating systems of internet-facing services are applied within two weeks of release, or within 48 hours if an exploit exists.