OPS-27.01B

Policies and procedures with technical and organisational measures are documented, communicated and provided in accordance with SP-01 to ensure system components under the responsibility of the cloud service provider are patched within a suitable time frame depending on contractual agreements and identified vulnerabilities or exploits. These policies and procedures contain specifications regarding the following aspects:

1. Software is kept up-to-date, including timely deployment of security patches;

2. Patches are scheduled within maintenance windows, where applicable, to minimise service disruption; and

3. Patches are tested in non-production environments before they are rolled out into the production environment, provided testing was successful. Mechanisms are in place to revert to previous software versions in case of unexpected issues.

Supplementary information

Patches are defined as software updates to systems components with the goal of increasing security by addressing issues, vulnerabilities or exploits.

Supplementary information

What constitutes as timely in the sense of this subcriterion depends on the criticality of the patched issue, vulnerability or exploit.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• BSI -

  Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)