+OPS.1.1.3.A1 Concept for Patch and Change Management [Process Owner] (B)

OPS.1.1.3.A1 Concept for Patch and Change Management [Process Owner] (B)

If IT components, software, or configuration data are changed, there MUST be specifications that also consider security aspects. These MUST be defined in a concept for patch and change management and followed accordingly. All patches and changes MUST be suitably planned, approved, and documented. Patches and changes SHOULD be suitably tested in advance (see also OPS.1.1.6 Software Tests and Approvals in this regard). If patches are installed and changes carried out, fallback solutions MUST be available. If there are major changes, the Chief Information Security Officer MUST also be involved. Overall, it MUST be ensured that the desired security level is maintained during and after the implementation of changes. In particular, the desired security settings SHOULD also be maintained.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations

Linked Issues

Issuelinks
blocks G 0.18 Poor Planning or Lack of Adaptation