OPS-27 Managing Vulnerabilities - Patch Management Policies and Procedures

Policies and procedures with technical and organisational measures are documented, communicated and provided in accordance with SP-01 to ensure system components under the responsibility of the cloud service provider are patched within a suitable time frame depending on contractual agreements and identified vulnerabilities or exploits. These policies and procedures contain specifications regarding the following aspects:

1. Software is kept up-to-date, including timely deployment of security patches;

2. Patches are scheduled within maintenance windows, where applicable, to minimise service disruption; and

3. Patches are tested in non-production environments before they are rolled out into the production environment, provided testing was successful. Mechanisms are in place to revert to previous software versions in case of unexpected issues.

Supplementary information

Patches are defined as software updates to systems components with the goal of increasing security by addressing issues, vulnerabilities or exploits.

Supplementary information

What constitutes as timely in the sense of this subcriterion depends on the criticality of the patched issue, vulnerability or exploit.

Patch management procedures are harmonised with the cloud service provider's overall software change management process (cf. DEV-03).

Supplementary information

Patches are defined as software updates to systems components with the goal of increasing security by addressing issues, vulnerabilities or exploits.

According to the measures and procedures of the overall change management, patches provided by third parties are identified, tested and deployed.

Supplementary information

Patches are defined as software updates to systems components with the goal of increasing security by addressing issues, vulnerabilities or exploits.

Systems are scanned after application of patches to ensure vulnerabilities and exploits are remediated and no known or unmitigated vulnerabilities or exploits were deployed.

Supplementary information

Patches are defined as software updates to systems components with the goal of increasing security by addressing issues, vulnerabilities or exploits.

Supplementary information

The scans performed after the application of a patch can, but do not have to be, restricted to the system components to which the patch was applied.

According to the measures and procedures of the overall change management, patches provided by third parties are identified, tested and deployed in an automated manner. In case of patches where manual intervention is required, an exception handling process for manual patching is defined.

Supplementary information

Patches are defined as software updates to systems components with the goal of increasing security by addressing issues, vulnerabilities or exploits.