Patch Management
What is Patch Management?
The process of identifying, acquiring, testing, and installing software updates (patches) to address security vulnerabilities and bugs. Effective patch management is a critical security control required by most compliance frameworks.
Terms that appear alongside patch management
Each of these is named in at least one of the same controls as patch management. The number is how many controls name both.
- vulnerability 28 shared controls
- baseline 12 shared controls
- configuration management 10 shared controls
- nist 10 shared controls
- hardening 10 shared controls
- malware 9 shared controls
- vulnerability scanning 8 shared controls
- network segmentation 8 shared controls
Frameworks that govern patch management
What the standards actually require on patch management
Requirements naming patch management across 6 standards, quoted from the control text.
Patch management reports are reviewed and show which security patches are missing.
ffiec-cybersecurity-assessment-tool-cat::D3.CC.Pa.B.3 · D3.CC.Pa.B.3 Patch Management (Baseline 3) →Management runs a patch management program that documents patch installations under change management, implements automated patch management so that servers, virtual machines, routers, switches, mobile devices and firewalls are updated, keeps a record of the v...
ffiec-it-examination-handbook::AIO-VI.B.3(b) · VI.B.3(b) Patch Management (Architecture, Infrastructure, and Operations) →The service provider shall manage security patches for the Automation Solution: qualification of patches against the solution, communication of patch applicability to the asset owner, and installation under change control.
iec-62443::SP.11 · Patch management →Keep applications on enterprise assets updated by automated patch management, running at least once a month.
CIS-7.4 · Perform Automated Application Patch Management →Keep applications on enterprise assets current through automated patching that runs at least monthly. Implementation Groups: IG1, IG2 and IG3 (part of the IG1 essential cyber hygiene baseline, so every enterprise applies it). Asset type: Software.
cis-controls-v8-1::7.4 · Perform Automated Application Patch Management →A patch management strategy ensuring all critical security patches and updates on Critical Cyber Systems are current.
tsa-pipeline-cybersecurity-directives::SD02-III.E.1 · SD02 III.E.1 Patch management strategy keeping critical patches current →Questions people ask about patch management
What is Patch Management?
Why is Patch Management important for compliance?
Which compliance frameworks address Patch Management?
Where can I learn more about Patch Management?
See how Patch Management applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.