GRC в кибербезопасности Пунктов: 14
Patch Management Program Audit
Этот чек-лист на английском языке.
Audits the patch management lifecycle including coverage, prioritization, deployment cadence, and exception handling across enterprise assets.
CIS v8NIST 800-40NIST 800-53
Бесплатно в PDF или Word · укажите email, чтобы скачать.
Program & Coverage
- Is a documented patch management policy with defined roles maintained? *
- Is automated patch management deployed for operating systems? *
- Is automated patch management deployed for applications? *
- Are firmware, network devices, and appliances included in patching scope?
Prioritization & SLAs
- Are patches prioritized using severity, exploitability, and asset criticality? *
- Are remediation SLAs defined by risk rating? *
- Are known-exploited vulnerabilities (CISA KEV) prioritized for expedited patching? *
- What is the SLA in days for remediating critical vulnerabilities?
Testing & Deployment
- Are patches tested in a staging environment before broad deployment? *
- Are deployments phased with rollback capability? *
- Is patch deployment success rate tracked and reported? *
Exceptions & Verification
- Are patch exceptions and deferrals formally approved with compensating controls? *
- Is patch application verified through vulnerability scanning? *
- Are legacy or unpatchable systems isolated and tracked?
Скачайте полный чек-лист «Patch Management Program Audit»
Получите его бесплатно в виде аккуратного PDF для печати или редактируемого документа Word.