サイバーセキュリティGRC 14項目
Patch Management Program Audit
このチェックリストは英語版です。
Audits the patch management lifecycle including coverage, prioritization, deployment cadence, and exception handling across enterprise assets.
CIS v8NIST 800-40NIST 800-53
無料のPDFまたはWord・メールアドレスを入力してダウンロード。
Program & Coverage
- Is a documented patch management policy with defined roles maintained? *
- Is automated patch management deployed for operating systems? *
- Is automated patch management deployed for applications? *
- Are firmware, network devices, and appliances included in patching scope?
Prioritization & SLAs
- Are patches prioritized using severity, exploitability, and asset criticality? *
- Are remediation SLAs defined by risk rating? *
- Are known-exploited vulnerabilities (CISA KEV) prioritized for expedited patching? *
- What is the SLA in days for remediating critical vulnerabilities?
Testing & Deployment
- Are patches tested in a staging environment before broad deployment? *
- Are deployments phased with rollback capability? *
- Is patch deployment success rate tracked and reported? *
Exceptions & Verification
- Are patch exceptions and deferrals formally approved with compensating controls? *
- Is patch application verified through vulnerability scanning? *
- Are legacy or unpatchable systems isolated and tracked?
Patch Management Program Auditチェックリストの完全版をダウンロード
印刷しやすいPDF、または編集可能なWord文書で無料で入手できます。