---
title: "Essential Eight patch applications: timeframes | CCP"
description: "Essential Eight application patching: the deadlines at Maturity Level 1, 2 and 3 for browsers, Office, PDF and internet-facing software, and how to meet them."
url: "https://ccp.com.au/essential-eight/patch-applications/"
datePublished: "2026-04-18"
dateModified: "2026-09-28"
author: "Computer Consultant Professionals"
---

# Essential Eight patch applications

## Close known holes before attackers find them.

Patching applications means installing vendor security fixes for browsers, Office, PDF readers and anything reachable from the internet, within set deadlines.

At a glance

Control

02 of 08 · Prevent attacks

Stops

Exploits of known software flaws

Typical tools

Intune, a patch management platform, a vulnerability scanner

Effort

Medium, ongoing

Changing ASD is replacing the Essential Eight with a new Essentials series. The work you do now still counts. [What’s changing ](https://ccp.com.au/essential-eight/essentials-series/)

## What is application patching?

### Where it stops an attack.

1.  The attack A flaw in a VPN or PDF reader is published, and attackers scan the internet for copies that haven’t been fixed.
3.  Stopped here The fix was installed inside the deadline, before the scan reached you.
5.  The result The known way in is already closed.

## Essential 8 patching timeframes for applications

### What changes at each level.

What changes ML1 ML2 ML3

Online services 48 hours if critical or exploited, otherwise 2 weeks No change No change

Office, browsers, email, PDF and security software 2 weeks No change 48 hours if critical or exploited, otherwise 2 weeks

All other applications Not required 1 month No change

Asset discovery and scanning Discovery fortnightly. Scans daily for online services, weekly for common appsAdds fortnightly scans of other apps No change

Unsupported software Remove online services and common apps No change Remove all unsupported applications

Each level includes everything in the one before. A plain-English summary, not the requirement text. [ASD Essential Eight Maturity Model (November 2023)](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model)

[Check where you are with the free self-assessment](https://ccp.com.au/resources/essential-eight-checklist/)

## How to patch applications

### Protection first, disruption last.

1.  01

    #### Know what you have

    An automated software inventory across every device, refreshed at least fortnightly.

2.  02

    #### Automate the common apps

    Browsers, Microsoft 365 apps and PDF readers update themselves, with reports to prove it.

3.  03

    #### Fast-track internet-facing systems

    Firewalls, VPNs and remote access get a 48-hour process for critical or exploited flaws.

4.  04

    #### Retire unsupported software

    If the vendor has stopped patching it, remove or replace it.

[Related service: Managed IT support](https://ccp.com.au/services/managed-it/)

## Common application patching mistakes

### Where rollouts go wrong.

-   #### Trusting auto-update blindly

    Updates fail silently. Without reports you don’t know who is behind.

-   #### Forgetting the firewall and VPN

    They run software too, and attackers scan for them first.

-   #### Keeping old software “just in case”

    Unsupported PDF readers and runtimes are easy targets.

## Application patching questions

### What clients ask before we start.

### How quickly do we need to patch applications?

At Maturity Level 1, online services get 48 hours for a critical or exploited flaw and two weeks otherwise. Office, browsers, email, PDF and security software get two weeks. At Maturity Level 3, those apps also get 48 hours for critical or exploited flaws.

### Does Microsoft 365 patch itself?

Microsoft 365 apps update automatically when configured correctly. You still need reports to prove it, and a plan for everything that isn’t Microsoft.

### What counts as an online service?

Anything you run that is reachable from the internet: VPNs, remote desktop gateways, firewall management portals, web servers and client portals.