Essential Eight mitigation strategy for finding and patching vulnerabilities in online services and applications, and removing unsupported applications, with scanning cadences and patch deadlines at each maturity level.
Patch applications at Maturity Level One: fortnightly asset discovery, daily and weekly vulnerability scanning, 48 hour and two week patch deadlines for online services, two week deadlines for common user applications, and removal of unsupported ones.
Patch applications at Maturity Level Two: everything at ML1 plus fortnightly scanning and a one month patch deadline for all other applications, alongside the log protection, analysis and incident reporting the ML2 baseline adds.
Patch applications at Maturity Level Three: critical vulnerabilities in common user applications must be patched within 48 hours, and every unsupported application must be removed, not only the common categories.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.