Essential Eight mitigation strategy for scanning and patching operating systems, replacing unsupported ones, and at ML3 patching drivers and firmware and running a current operating system release.
Patch operating systems at Maturity Level One: daily scanning and 48 hour or two week deadlines for internet-facing servers and network devices, fortnightly scanning and a one month deadline for workstations and internal systems, and replacing unsupported operating systems.
Patch operating systems at Maturity Level Two: the operating system patching controls match ML1, so the step up comes from the logging, log analysis and incident response controls the ML2 baseline adds.
Patch operating systems at Maturity Level Three: 48 hour deadlines for critical vulnerabilities on all systems, patching and scanning of drivers and firmware, and use of the latest or previous operating system release.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.