Maintenance Window

Document, communicate and provide audit planning and conduct rules that confine auditors to read only access within the agreed plan, place potentially disruptive activity into maintenance windows or off peak periods, and require audit activity to be logged and...

Management establishes a preventive maintenance plan, especially for mission-critical systems, scheduled by criticality, developer recommendations, operational risk and emerging technology and threats, aligned with business plans and timed after hours, at week...

NSS-17 + NSS-42-G require vulnerability + patch management + removable media + portable device controls. Vulnerability management: vendor security advisories + CVE feeds + ICS-CERT + national CERT subscriptions;

Makes sure services are as available as agreed (availability being the ability of a service or component to carry out its agreed function when needed), so customers and users get what they need. It negotiates and agrees targets that can be met;

Establish an OT patch management process that tests patches in a representative environment, schedules deployment during maintenance windows, and applies compensating controls when patching is not feasible.

Maintain API performance per Operational Guidelines including 99.5% minimum availability + p95 latency under 1.5 seconds + p99 latency under 3 seconds + throughput targets per tier + reporting of all API operations metrics monthly to CBN.