Patch-Management-Standard-IT 标准: 补丁管理.docx

PatchManagementStandard PagePAGE4ofSECTIONPAGES3

PatchManagementStandard PagePAGE1ofSECTIONPAGES3

[entity]

InformationTechnologyStandard

No:

ITStandard:

PatchManagement

Updated:

IssuedBy:

Owner:

1.0PurposeandBenefits

Securitypatchmanagement(patchmanagement)isapracticedesignedtoproactivelypreventtheexploitationofITvulnerabilitiesthatexistwithinanorganization.Byapplyingsecurityrelatedsoftwareorfirmwareupdates(patches)toapplicableITsystems,theexpectedresultisreducedtimeandmoneyspentdealingwithexploitsbyreducingoreliminatingtherelatedvulnerability.

2.0Authority

[OrganizationAuthorityNeeded]

3.0Scope

Thisstandardrelatesspecificallytovulnerabilitiesthatcanbeaddressedbyasoftwareorfirmwareupdate(patch)andappliestoallsoftwareusedontheentity’ssystems.TheVulnerabilityScanningStandardshouldbefollowedforrequirementsonaddressingnon-patchedvulnerabilities.

4.0InformationStatement

EntitiesmustassignanindividualorgroupwithinIToperationstoberesponsibleforpatchmanagement.

Ifpatchmanagementisoutsourced,servicelevelagreementsmustbeinplacethataddresstherequirementsofthisstandardandoutlineresponsibilitiesforpatching.Ifpatchingistheresponsibilityofthethirdparty,entitiesmustverifythatthepatcheshavebeenapplied.

Aprocessmustbeinplacetomanagepatches.Thisprocessmustincludethefollowing:

monitoringsecuritysources(AppendixA)forvulnerabilities,patchandnon-patchremediation,andemergingthreats;

overseeingpatchdistribution,includingverifyingthatachangecontrolprocedureisbeingfollowed;

testingforstabilityanddeployingpatches;and

usinganautomatedcentralizedpatchmanagementdistributiontool,whenevertechnicallyfeasible,which:

maintainsadatabaseofpatches;

deployspatchestoendpoints;and

verifiesinstallationofpatches.

Appropriateseparationofdutiesmus