+6.6. Security patch management
---+6.6.1. The relevant entities shall specify and apply procedures, coherent with the change …
---+6.6.2. By way of derogation from point 6.6.1(a), the relevant entities may choose not to apply …
|
6.6. Security patch management
6.6. Security patch management
1. Übersicht
| Bezeichnung |
Regulierung |
|
6.6.1. The relevant entities shall specify and apply procedures, coherent with the change …
|
|
6.6.1.
|
The relevant entities shall specify and apply procedures, coherent with the change management procedures referred to in point 6.4.1 as well as with vulnerability management, risk management and other relevant management procedures, for ensuring that:
|
(a)
|
security patches are applied within a reasonable time after they become available;
|
|
(b)
|
security patches are tested before being applied in production systems;
|
|
(c)
|
security patches come from trusted sources and are checked for integrity;
|
|
(d)
|
additional measures are implemented and residual risks are accepted in cases where a patch is not available or not applied pursuant to point 6.6.2.
|
|
|
|
6.6.2. By way of derogation from point 6.6.1(a), the relevant entities may choose not to apply …
|
|
6.6.2.
|
By way of derogation from point 6.6.1(a), the relevant entities may choose not to apply security patches when the disadvantages of applying the security patches outweigh the cybersecurity benefits. The relevant entities shall duly document and substantiate the reasons for any such decision.
|
|
,
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Standards
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Standards
Standards
| Quelle |
Anforderung |
Verknüpfte Vorgänge
|