The purpose of this policy is to establish guidelines for vulnerability management and patching to ensure the security of our organization's assets and data.
Scope
This policy applies to all employees, contractors, and vendors who have access to our organization's systems and data.
Vulnerability Management
Regular vulnerability scans will be conducted on all systems and applications.
Identified vulnerabilities will be assessed based on their severity and risk to the organization.
Remediation plans will be developed and implemented for all identified vulnerabilities.
All critical and high-risk vulnerabilities will be remediated within 30 days of identification.
Medium and low-risk vulnerabilities will be remediated based on their severity and the organization's resources.
Patch Management
All systems and applications will be updated with the latest security patches within 30 days of release.
Critical patches will be prioritized and applied immediately.
Patch management will be automated wherever possible to ensure timely updates.
Patching schedules will be communicated to all stakeholders in advance.
Exceptions
Exceptions to this policy may be granted on a case-by-case basis by the IT Security team. All exceptions must be documented and approved by management.
Non-Compliance
Non-compliance with this policy may result in disciplinary action, up to and including termination of employment or contract.
Revision History
Date of Change
Policy
Notes
Date of Change
Policy
Notes
1
1/31/2022
Vulnerability Management & Patch Policy
Policy created
No results from filter
Accept
1
Vulnerability Management & Patch Policy 1.0
By clicking this button I acknowledge that I have read the above policy and agree to comply with the policy