Patch Management
What is Patch Management?
The process of identifying, acquiring, testing, and installing software updates (patches) to address security vulnerabilities and bugs. Effective patch management is a critical security control required by most compliance frameworks.
Terms that appear alongside patch management
Each of these is named in at least one of the same controls as patch management. The number is how many controls name both.
- vulnerability 28 shared controls
- baseline 12 shared controls
- configuration management 10 shared controls
- nist 10 shared controls
- hardening 10 shared controls
- malware 9 shared controls
- vulnerability scanning 8 shared controls
- network segmentation 8 shared controls
Frameworks that govern patch management
What the standards actually require on patch management
Requirements naming patch management across 6 standards, quoted from the control text.
Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.
CIS-7.4 · Perform Automated Application Patch Management →Security patches are tracked and applied within risk-based SLAs with documented exceptions for delays.
IS-V.A.3 · Patch Management →Security patch management for OT. Control from IEC 62443 framework, domain: IEC 62443: Systems Security.
IEC62443-11 · Security patch management for OT →Establish a patch management process for timely application of security updates to IT and OT systems.
AWWA-4.2 · Patch Management →Patch management processes, and supporting patch management procedures, are developed, implemented and maintained.
ISM-1143 · Patch management processes, and supporting patch management procedures, are developed, imp →Patch Management. RLEs must have patch management procedures that define the identification, categorisation, prioritisation and timely deployment of patches (para 57).
BMA-22 · Patch Management →Questions people ask about patch management
What is Patch Management?
Why is Patch Management important for compliance?
Which compliance frameworks address Patch Management?
Where can I learn more about Patch Management?
See how Patch Management applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.