网络安全 GRC 14 项
Patch Management Program Audit
此检查清单为英文版。
Audits the patch management lifecycle including coverage, prioritization, deployment cadence, and exception handling across enterprise assets.
CIS v8NIST 800-40NIST 800-53
免费 PDF 或 Word · 输入邮箱即可下载。
Program & Coverage
- Is a documented patch management policy with defined roles maintained? *
- Is automated patch management deployed for operating systems? *
- Is automated patch management deployed for applications? *
- Are firmware, network devices, and appliances included in patching scope?
Prioritization & SLAs
- Are patches prioritized using severity, exploitability, and asset criticality? *
- Are remediation SLAs defined by risk rating? *
- Are known-exploited vulnerabilities (CISA KEV) prioritized for expedited patching? *
- What is the SLA in days for remediating critical vulnerabilities?
Testing & Deployment
- Are patches tested in a staging environment before broad deployment? *
- Are deployments phased with rollback capability? *
- Is patch deployment success rate tracked and reported? *
Exceptions & Verification
- Are patch exceptions and deferrals formally approved with compensating controls? *
- Is patch application verified through vulnerability scanning? *
- Are legacy or unpatchable systems isolated and tracked?
下载完整的Patch Management Program Audit检查清单
免费获取排版清晰、便于打印的 PDF，或可编辑的 Word 文档。