The Essential Eight asks you to scan online services every day and patch them within 48 hours when a vulnerability is critical or exploited. MopokeHQ watches the packages, runtimes and container images inside the web apps and APIs you ship, sets the clock, and records when the fix reached production.
Two of the eight strategies cover patching: patch applications and patch operating systems. This is what ASD’s Essential Eight Maturity Model (last reviewed 27 November 2023) asks for online services and internet-facing servers.
| Requirement | Maturity Level One | Maturity Level Two | Maturity Level Three |
|---|---|---|---|
| Automated asset discovery | At least fortnightly | At least fortnightly | At least fortnightly |
| Vulnerability scanning of online services | At least daily | At least daily | At least daily |
| Patch online services, critical or working exploit | 48 hours of release | 48 hours of release | 48 hours of release |
| Patch online services, everything else | Two weeks of release | Two weeks of release | Two weeks of release |
| Scan and patch other applications | Not required | Fortnightly scan, one month | Fortnightly scan, one month |
| Operating systems of internet-facing servers | Daily scan, 48 hours or two weeks | Daily scan, 48 hours or two weeks | Daily scan, 48 hours or two weeks |
The clock starts when the patch is released. For a working exploit, ASD’s FAQ says it starts when the exploit is announced or exploitation begins, whichever comes first.
ASD defines an online service as any service directly reachable over the internet, including one behind a perimeter firewall. A customer portal is one. So is a public API. When a package inside that service has a known vulnerability, so does the service.
That is where MopokeHQ works: the npm and Composer packages, PHP and Node runtimes and container images that make up what you deploy.
One CI include line runs the scan on your runners and uploads an SBOM.
New advisories are checked against every stored SBOM as they land.
The Essential Eight preset gives 48 hours when critical or exploited, two weeks otherwise.
Findings grouped by the upgrade that closes them, fix merge requests from your runner.
Closed only when the fixed version is seen deployed.
Pick Essential Eight and a period, and the evidence pack is ready.
The Essential Eight covers far more than the software you build. Here is where MopokeHQ’s records apply and where they do not.
| Essential Eight requirement | MopokeHQ evidence | Coverage |
|---|---|---|
| Automated asset discovery | An SBOM from every pipeline, deployment reports per environment, and port discovery on verified external targets | Services you connect |
| Scanner with an up-to-date vulnerability database | OSV, php.net, CISA KEV and FIRST EPSS feeds. Each match is logged with its source and time. | Supported ecosystems |
| Scan online services at least daily | Every stored SBOM is re-matched whenever an advisory lands. External passive checks run daily, template scans weekly. | Services you connect |
| Patch within 48 hours if critical or exploited | Essential Eight preset deadline. Known exploited is P1 with instant email and escalation after 4 hours. Closure logged when the fix is seen deployed. | Covered |
| Patch within two weeks otherwise | Essential Eight preset deadline, closed on a confirmed deployment | Covered |
| Operating systems of internet-facing servers | Container image scanning and runtime OS version reports | Partial |
| Office suites, browsers, email clients, PDF software, security products | Not covered | Endpoint management |
| Workstations, internal servers, drivers, firmware | Not covered | Endpoint management |
MopokeHQ does not address the other six strategies: application control, Office macros, user application hardening, administrative privileges, multi-factor authentication and backups.
ASD’s trigger for 48 hours is a vulnerability the vendor rates critical, or one with a working exploit. ASD points to the CISA Known Exploited Vulnerabilities catalogue as one way to check for working exploits, and MopokeHQ watches it continuously.
The Essential Eight preset sets those deadlines on top of MopokeHQ’s own priorities, and the evidence pack shows each finding’s deadline next to the time the fixed version reached production.
On 15 October 2026 ASD launched ASD Essentials. Its enterprise IT chapter is described as an evolution of the Essential Eight. ASD will maintain both during the transition and says organisations should keep meeting their current obligations until regulators announce changes.
Under ASD Essentials, patching sits in the vulnerability management principle. Its effectiveness indicators ask for continuous scanning, risk-based timeframes, remediation verified to have worked, and historical data showing consistent performance. Those are the records MopokeHQ keeps.
ASD’s assessment process guide ranks evidence: a policy or verbal statement is poor, a report is fair, reviewing the system is good, testing the control is excellent.
For online services the guide suggests comparing each version and install date with the patch release date. MopokeHQ holds versions and deployment times per environment, in the pack and in the app, where an assessor can open any finding and see its deadline and the deployment that closed it.
For agencies and MSPs. Each client can get its own Essential Eight evidence pack in your branding, for the period they ask about. MopokeHQ for agencies
For online services, at every maturity level: within 48 hours of release when the vendor rates the vulnerability critical or a working exploit exists, otherwise within two weeks. Operating systems of internet-facing servers follow the same rule. From Maturity Level Two, other applications have one month.
Everything in Level One, plus fortnightly scanning of other applications and patching them within one month of release. Online services still need daily scanning and the 48 hour or two week deadlines.
No. ASD says there is no requirement to have your implementation certified by an independent party. You may still need an independent assessment if a government directive, regulator or contract requires one.
ASD launched ASD Essentials on 15 October 2026. Its enterprise IT chapter is described as an evolution of the Essential Eight. ASD is maintaining both during the transition and says organisations should keep meeting current obligations until regulators announce changes.
ASD defines an online service as any service directly reachable over the internet, including one behind a perimeter firewall, and gives a web portal as an example.
From the release of the patch. For a working exploit, ASD’s FAQ says the clock runs from the announcement of the exploit or the start of exploitation, whichever comes first.
ASD points to vendors, its own advisories, researchers and the CISA Known Exploited Vulnerabilities catalogue. MopokeHQ watches that catalogue and treats known-exploited findings as P1.
No. MopokeHQ covers the services you build and deploy: their packages, runtimes and container images. Use your endpoint management for workstations, office suites, browsers, drivers and firmware.
One job in your CI pipeline. Your first SBOM is matched against every advisory we hold within minutes.