# Patch applications
<a name="patch-applications"></a>


| 
| 
| Essential Eight control | Implementation guidance | AWS resources | AWS Well-Architected guidance | 
| --- |--- |--- |--- |
| An automated method of asset discovery is used at least fortnightly to support the detection of assets for subsequent vulnerability scanning activities. | [Theme 1: Use managed services](theme-1.md): Scan for vulnerabilities<br />[Theme 2: Manage immutable infrastructure through secure pipelines](theme-2.md): Implement vulnerability scanning<br />[Theme 3: Manage mutable infrastructure with automation](theme-3.md): Implement vulnerability scanning | [Enable Amazon Inspector in all accounts in your organization](https://docs.aws.amazon.com/inspector/latest/user/designating-admin.html)<br />[Configure enhanced scanning for Amazon ECR repositories by using Amazon Inspector](https://docs.aws.amazon.com/inspector/latest/user/scanning-ecr.html#configure-ecr)<br />[Build a vulnerability management program to triage and remediate security findings](https://docs.aws.amazon.com/prescriptive-guidance/latest/vulnerability-management/) | [SEC06-BP01 Perform vulnerability management](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_protect_compute_vulnerability_management.html)<br />[SEC06-BP05 Automate compute protection](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_protect_compute_auto_protection.html) | 
| [Theme 7: Centralise logging and monitoring](theme-7.md): Centralise logs | [Receive CloudTrail logs from multiple accounts](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-receive-logs-from-multiple-accounts.html)<br />[Send logs to a log archive account](https://docs.aws.amazon.com/whitepapers/latest/organizing-your-aws-environment/security-ou-and-accounts.html#log-archive-account)<br />[Centralise CloudWatch Logs in an account for auditing and analysis](https://aws.amazon.com/blogs/architecture/stream-amazon-cloudwatch-logs-to-a-centralized-account-for-audit-and-analysis/) (AWS blog post)<br />[Centralize management of Amazon Inspector](https://docs.aws.amazon.com/inspector/latest/user/managing-multiple-accounts.html)<br />[Create an organisation-wide aggregator in AWS Config](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-trail-organization.html) (AWS blog post)<br />[Centralise management of Security Hub CSPM](https://docs.aws.amazon.com/securityhub/latest/userguide/designate-orgs-admin-account.html)<br />[Centralise management of GuardDuty](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_organizations.html)<br />[Consider using Security Lake](https://docs.aws.amazon.com/security-lake/latest/userguide/what-is-security-lake.html) | [SEC04-BP02 Capture logs, findings, and metrics in standardized locations](https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_detect_investigate_events_logs.html) | 
| A vulnerability scanner with an up-to-date vulnerability database is used for vulnerability scanning activities. | [Theme 1: Use managed services](theme-1.md): Scan for vulnerabilities<br />[Theme 2: Manage immutable infrastructure through secure pipelines](theme-2.md): Implement vulnerability scanning<br />[Theme 3: Manage mutable infrastructure with automation](theme-3.md): Implement vulnerability scanning | [Enable Amazon Inspector in all accounts in your organization](https://docs.aws.amazon.com/inspector/latest/user/designating-admin.html)<br />[Configure enhanced scanning for Amazon ECR repositories by using Amazon Inspector](https://docs.aws.amazon.com/inspector/latest/user/scanning-ecr.html#configure-ecr)<br />[Build a vulnerability management program to triage and remediate security findings](https://docs.aws.amazon.com/prescriptive-guidance/latest/vulnerability-management/) | [SEC06-BP01 Perform vulnerability management](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_protect_compute_vulnerability_management.html)<br />[SEC06-BP05 Automate compute protection](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_protect_compute_auto_protection.html) | 
| A vulnerability scanner is used at least daily to identify missing patches or updates for security vulnerabilities in internet-facing services. | 
| A vulnerability scanner is used at least weekly to identify missing patches or updates for security vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products. | See [Technical example: Patch applications](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/small-business-cyber-security/small-business-cloud-security-guide/technical-example-patch-applications) (ACSC website) | Not applicable | Not applicable | 
| A vulnerability scanner is used at least fortnightly to identify missing patches or updates for security vulnerabilities in other applications. | [Theme 1: Use managed services](theme-1.md): Scan for vulnerabilities<br />[Theme 2: Manage immutable infrastructure through secure pipelines](theme-2.md): Implement vulnerability scanning<br />[Theme 3: Manage mutable infrastructure with automation](theme-3.md): Implement vulnerability scanning | [Enable Amazon Inspector in all accounts in your organization](https://docs.aws.amazon.com/inspector/latest/user/designating-admin.html)<br />[Configure enhanced scanning for Amazon ECR repositories by using Amazon Inspector](https://docs.aws.amazon.com/inspector/latest/user/scanning-ecr.html#configure-ecr)<br />[Build a vulnerability management program to triage and remediate security findings](https://docs.aws.amazon.com/prescriptive-guidance/latest/vulnerability-management/) | [SEC06-BP01 Perform vulnerability management](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_protect_compute_vulnerability_management.html)<br />[SEC06-BP05 Automate compute protection](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_protect_compute_auto_protection.html) | 
| Patches, updates or vendor mitigations for security vulnerabilities in internet-facing services are applied within two weeks of release, or within 48 hours if an exploit exists. | [Theme 1: Use managed services](theme-1.md): Scan for vulnerabilities<br />[Theme 2: Manage immutable infrastructure through secure pipelines](theme-2.md): Implement vulnerability scanning<br />[Theme 3: Manage mutable infrastructure with automation](theme-3.md): Implement vulnerability scanning | [Enable Amazon Inspector in all accounts in your organization](https://docs.aws.amazon.com/inspector/latest/user/designating-admin.html)<br />[Configure enhanced scanning for Amazon ECR repositories by using Amazon Inspector](https://docs.aws.amazon.com/inspector/latest/user/scanning-ecr.html#configure-ecr)<br />[Build a vulnerability management program to triage and remediate security findings](https://docs.aws.amazon.com/prescriptive-guidance/latest/vulnerability-management/) | [SEC06-BP01 Perform vulnerability management](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_protect_compute_vulnerability_management.html) | 
| [Theme 3: Manage mutable infrastructure with automation](theme-3.md): Automate patching | [Enable Patch Manager in all accounts in your AWS organization](https://docs.aws.amazon.com/prescriptive-guidance/latest/patch-management-hybrid-cloud/design-standard.html) | [SEC06-BP01 Perform vulnerability management](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_protect_compute_vulnerability_management.html)<br />[SEC06-BP05 Automate compute protection](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_protect_compute_auto_protection.html) | 
| Patches, updates or vendor mitigations for security vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products are applied within two weeks of release, or within 48 hours if an exploit exists. | See [Technical example: Patch applications](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/small-business-cyber-security/small-business-cloud-security-guide/technical-example-patch-applications) (ACSC website) | Not applicable | Not applicable | 
| Patches, updates or vendor mitigations for security vulnerabilities in other applications are applied within one month of release. | [Theme 1: Use managed services](theme-1.md): Scan for vulnerabilities<br />[Theme 2: Manage immutable infrastructure through secure pipelines](theme-2.md): Implement vulnerability scanning<br />[Theme 3: Manage mutable infrastructure with automation](theme-3.md): Implement vulnerability scanning | [Enable Amazon Inspector in all accounts in your organization](https://docs.aws.amazon.com/inspector/latest/user/designating-admin.html)<br />[Configure enhanced scanning for Amazon ECR repositories by using Amazon Inspector](https://docs.aws.amazon.com/inspector/latest/user/scanning-ecr.html#configure-ecr)<br />[Build a vulnerability management program to triage and remediate security findings](https://docs.aws.amazon.com/prescriptive-guidance/latest/vulnerability-management/) | [SEC06-BP01 Perform vulnerability management](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_protect_compute_vulnerability_management.html) | 
| [Theme 3: Manage mutable infrastructure with automation](theme-3.md): Automate patching | [Enable Patch Manager in all accounts in your AWS organization](https://docs.aws.amazon.com/prescriptive-guidance/latest/patch-management-hybrid-cloud/design-standard.html) | [SEC06-BP01 Perform vulnerability management](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_protect_compute_vulnerability_management.html)<br />[SEC06-BP05 Automate compute protection](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_protect_compute_auto_protection.html) | 
| Applications that are no longer supported by vendors are removed. | [Theme 8: Implement mechanisms for manual processes](theme-8.md): Implement mechanisms to review and address compliance gaps | Consider using [AWS Systems Manager Inventory](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-inventory.html) to gain visibility into which instances are running software required by your software policy | [SEC06-BP02 Provision compute from hardened images](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_protect_compute_hardened_images.html) |