2.0 KiB
2.0 KiB
Vulnerability & Patch Management Guidance
Document owner: [Owner/Role]
Approved by: [Steering Committee / CISO]
Effective date: [YYYY-MM-DD]
Review cadence: [Annually]
1. Purpose & Scope
Implementation guidance for the Vulnerability & Patch Management Policy. Applies to IT, security operations, and system owners.
2. Prioritization — Practical Order
- Check the finding against the CISA KEV catalog first — actively exploited beats a higher CVSS score that's theoretical.
- Cross-reference against kill-chain asset inventory (per Authentication Policy §2.1) — same CVE on a kill-chain system jumps the queue.
- Then fall back to CVSS-based SLA table in policy §2.2.
3. Patch Testing Before Rollout
- Kill-chain and production-critical systems: patch in a staging/canary group first, even under an accelerated SLA — an emergency patch that breaks production is not a win.
- Low-priority systems: standard maintenance window testing is sufficient.
4. Exception Tracking
- Every SLA exception needs: system, CVE, compensating control (e.g., network isolation, WAF rule), owner, and review date ≤90 days out.
- Review the exception list monthly — an exception with no progress after two review cycles escalates to CISO.
5. Checklist
✅ Weekly external / monthly internal scanning running and reviewed.
✅ KEV catalog checked against current open findings weekly.
✅ Kill-chain systems on continuous scanning where tooling allows.
✅ Exception list reviewed monthly, none open past 90 days without CISO sign-off.
✅ Emergency patch process tested at least once — don't discover the process during a real zero-day.