Short answer: the Essential Eight sets patching timeframes by maturity level and by system type. For operating systems of internet-facing servers, critical vulnerabilities must be patched within 48 hours at every maturity level. Non-internet-facing servers get one month at Levels One and Two. At Level Three, critical vulnerabilities on those servers also move to 48 hours.
This guide summarizes the “patch applications” and “patch operating systems” requirements in the Australian Signals Directorate (ASD) maturity model. It focuses on servers in healthcare and government, and on how to produce evidence for an assessment.
How the maturity model works
ASD defines four maturity levels, from Zero to Three. Organizations pick a target level and reach the same level across all eight strategies before moving higher. ASD asks for a risk-based approach, with exceptions documented, approved and reviewed regularly.
ASD notes that the Essential Eight was designed for internet-connected IT networks. It was not designed for operational technology, where other mitigations may fit better. That matters for clinical devices and isolated systems.
Patch operating systems: server timeframes
The table below summarizes the timeframes for server operating systems. “Critical” means the vendor assessed the vulnerability as critical, or a working exploit exists.
| Requirement | Level One | Level Two | Level Three |
|---|---|---|---|
| Internet-facing servers, critical | 48 hours | 48 hours | 48 hours |
| Internet-facing servers, non-critical | Two weeks | Two weeks | Two weeks |
| Non-internet-facing servers, critical | One month | One month | 48 hours |
| Non-internet-facing servers, non-critical | One month | One month | One month |
| Drivers and firmware | Not required | Not required | 48 hours critical; one month otherwise |
| Vulnerability scan, internet-facing servers | Daily | Daily | Daily |
| Vulnerability scan, non-internet-facing servers | Fortnightly | Fortnightly | Fortnightly |
At every level, an automated method of asset discovery must run at least fortnightly. Operating systems that vendors no longer support must be replaced. Level Three adds that you use the latest or previous release of an operating system.
Patch applications: what applies to servers
Application patching covers online services and common software. For servers, two rules matter most:
- Online services. Critical vulnerabilities within 48 hours, and others within two weeks, at every level.
- Other applications. From Level Two, applications outside the named categories must be patched within one month. They must be scanned at least fortnightly.
Browsers, office suites, email clients, PDF software and security products have their own rules. They need weekly scans and two-week patching at all levels. At Level Three, critical vulnerabilities in them drop to 48 hours.
Why servers are the hard part
- Change windows. A 48-hour target leaves little room for a monthly change board.
- Mixed estates. Hospitals and agencies run Windows, Linux and sometimes AIX or Solaris.
- Isolated systems. Clinical and control networks often have no internet access.
- Evidence. Assessors want proof of timeframes, not just a policy.
How JetPatch supports Essential Eight patching
JetPatch is a patch management platform. It works with your vulnerability scanner rather than replacing it. It integrates with Qualys, Tenable and Rapid7 so scan findings drive patch priorities.
- Asset discovery. JetPatch discovers servers from vCenter, AWS, Azure, Active Directory and WSUS, and groups them with Smart Groups.
- Two speeds of remediation. Remediation Plans support emergency zero-day response and scheduled maintenance. Use one for 48-hour fixes and one for monthly cycles.
- Fewer failed attempts. Predictive Patching simulates each cycle and exposes offline machines, credential problems and low disk space beforehand.
- Governed rollout. Sequence Patching moves updates from QA to production with success criteria per stage.
- SLA tracking and reports. Dashboards track SLA adherence. Reports export to CSV and PDF for assessors.
For Windows Server, JetPatch works with your existing WSUS or replaces it with the JetPatch repository. Its third-party catalog patches common applications through the WSUS pipeline. See Windows patch management.
For Linux, JetPatch reports at the advisory level, with CVE references for each RHSA. That makes it easier to show when a critical vulnerability was closed. See Linux patch management.
Isolated clinical or government servers can still follow a defined cadence. JetPatch patches restricted, partially isolated and fully air-gapped networks without giving servers internet access. See air-gapped patch management.
Building an evidence pack for assessment
Assessors look for proof that timeframes were met in practice. A useful evidence pack for servers includes:
- A current asset list, with internet-facing servers clearly marked.
- Vulnerability scan results that show the date each missing patch was found.
- Patch records that show the release date and the install date for each server.
- A list of documented exceptions, with compensating controls and review dates.
- A list of unsupported operating systems and the plan to replace them.
Split servers into internet-facing and non-internet-facing groups in your patch tool. Then each group can carry its own timeframe and report.
Frequently asked questions
What is the Essential Eight patch timeframe for critical vulnerabilities?
For internet-facing servers and online services, 48 hours at all maturity levels. For non-internet-facing servers, 48 hours applies at Level Three, and one month at Levels One and Two.
What counts as critical?
The model uses the vendor’s assessment. A vulnerability is treated as critical when the vendor rates it critical, or when working exploits exist.
Does the Essential Eight apply to air-gapped systems?
ASD says it was designed for internet-connected IT networks, not operational technology. Many organizations still apply its principles to isolated IT servers. Check your own policy and assessor guidance.
Do we need independent certification?
ASD says there is no general certification requirement. An independent assessment may be required by government policy, a regulator or a contract.
Working toward a higher maturity level for your servers? Request an evaluation to test JetPatch against your Essential Eight timeframes.
