حوكمة ومخاطر وامتثال الأمن السيبراني (GRC) 14 بند
Patch Management Program Audit
قائمة التحقق هذه باللغة الإنجليزية.
Audits the patch management lifecycle including coverage, prioritization, deployment cadence, and exception handling across enterprise assets.
CIS v8NIST 800-40NIST 800-53
PDF أو Word مجانًا · أدخل بريدك الإلكتروني للتنزيل.
Program & Coverage
- Is a documented patch management policy with defined roles maintained? *
- Is automated patch management deployed for operating systems? *
- Is automated patch management deployed for applications? *
- Are firmware, network devices, and appliances included in patching scope?
Prioritization & SLAs
- Are patches prioritized using severity, exploitability, and asset criticality? *
- Are remediation SLAs defined by risk rating? *
- Are known-exploited vulnerabilities (CISA KEV) prioritized for expedited patching? *
- What is the SLA in days for remediating critical vulnerabilities?
Testing & Deployment
- Are patches tested in a staging environment before broad deployment? *
- Are deployments phased with rollback capability? *
- Is patch deployment success rate tracked and reported? *
Exceptions & Verification
- Are patch exceptions and deferrals formally approved with compensating controls? *
- Is patch application verified through vulnerability scanning? *
- Are legacy or unpatchable systems isolated and tracked?
نزّل قائمة تحقق Patch Management Program Audit كاملة
احصل عليها مجانًا بصيغة PDF أنيقة قابلة للطباعة أو مستند Word قابل للتعديل.