Infrastructure Security · IS-Q02

Question: Are systems patched and updated in a timely, verifiable, and documented manner?

  1. Objective — Why This Matters
    Unpatched systems remain a primary breach vector. Timely patching reduces exposure and demonstrates operational discipline.

  2. Maturity Levels (0 – 5)

0 — Unaware
No patch policy; ad-hoc updates.
1 — Ad Hoc
Manual patching; no tracking or metrics.
2 — Defined
Patch policy exists; monthly cycle established.
3 — Managed
Automated deployment; exception register maintained.
4 — Integrated
Patch data feeds into CMDB/SIEM; metrics monitored.
5 — Optimized
Risk-based prioritization and continuous assessment.
  1. How to Level Up
From → To Actions
0 → 2 Define policy and publish SLA (critical ≤ 7 days).
2 → 3 Automate patching via Ansible / WSUS / Yum cron.
3 → 4 Feed status to CMDB or SIEM; alert on non-compliance.
4 → 5 Adopt vulnerability prioritization (CVSS + exploitability).

  1. People / Process / Technology Enablers
    People – Infrastructure and Security Operations.
    Process – Patch review, rollback plan, exception management.
    Technology – Ansible, WSUS, OpenVAS.

  2. Evidence Required
    Patch policy, automation logs, exception register.

  3. Metrics / KPIs
    • percentage of systems patched within SLA
    • average days to patch critical vulnerabilities
    • number of pending exceptions past due date

  4. Low-Cost / Open-Source Options (MSME)

Purpose Tool Notes
Scanning OpenVAS / Greenbone Detect missing patches and CVEs.
Automation Ansible / Yum cron Schedule and apply updates.
Metrics Wazuh / Grafana Dashboard patch age and compliance.

  1. Common Pitfalls
    Patches applied without reboot; no rollback testing.

  2. Compliance Mapping

Standard Clauses / Notes
ISO 27001 A.8.8 (Vulnerability management).
NIST CSF 2.0 PR.IP-12 / DE.CM-8.
CERT-In 2022 Timely patching requirement.
NIRMATA Scoring IS-Q02 ≥ Level 4 requires metrics-driven patch tracking.