Does your organization implement and adhere to defined timeframes for routine and emergency patching as specified in your vulnerability management plan?
Explanation
Patching timeliness is under review here: whether your vulnerability management plan defines timeframes for routine and emergency patching and whether you consistently meet them. Effective patch management requires differentiating between routine updates that can follow regular maintenance windows and emergency patches that address critical vulnerabilities requiring immediate attention.
Evidence could include your vulnerability management plan with clearly defined patching timeframes, patch deployment reports showing adherence to these timeframes, change management records documenting patch implementations, and metrics showing the percentage of systems patched within target timeframes for both routine and emergency scenarios.
Implementation Example
Perform routine and emergency patching within the timeframes specified in the vulnerability management plan
ID: PR.PS-02.241
Context
- Function
- PR: PROTECT
- Category
- PR.PS: Platform Security
- Sub-Category
- Software is maintained, replaced, and removed commensurate with risk
Related questions
- Has your organization established and maintained hardened baseline configurations for all systems that enforce security policies and provide only essential capabilities?
- Does your organization have a documented process for reviewing default configuration settings for security implications when installing or upgrading software?
- Does your organization have a process to monitor software for deviations from approved baselines?
- Does your organization follow an immutable infrastructure approach for container deployments by replacing rather than updating existing container instances when updates are required?
- Does your organization have a process to identify and replace end-of-life software and services with supported versions?
- Does your organization have a process to identify, uninstall, and remove unauthorized software and services that pose security risks?