Vulnerability and Patch Management Procedure

Purpose

This Procedure describes how we find, rate, fix, and verify technical vulnerabilities in the systems we operate, within deadlines that fit the risk.

Scope

It applies to servers, network equipment, workstations, and the applications and platforms that Tidewell IT operates for itself and for its customers.

Roles

• Change Manager: owns this Procedure, triages findings, and reports every month.
• System owners: patch the systems they are responsible for.
• ISMS Manager: records risk acceptances and watches the deadlines.
• Management Board: accepts the risk when a Critical deadline is missed.

Procedure

Find

1. Authenticated scans of all systems run every week.
2. Advisories from the vendors of our systems are read on the day they arrive.
3. The findings of penetration tests and audits are added to the same list.

Triage

1. Within 2 working days, the Change Manager rates each finding on its severity and on its exposure, and assigns it to a system owner.
2. Each finding is entered in the Vulnerabilities register with its rating, owner, and deadline.

Fix

1. The deadlines count from the rating: Critical 7 days, High 14 days, Medium 30 days, and Low 90 days.
2. A Critical vulnerability that is exploited in the wild must be fixed within 48 hours. It is handled as an Emergency change.
3. The system owner applies the fix through the Change Management Procedure and tests it first.
4. When a fix is not possible in time, compensating controls are applied at once. Examples are blocking the exposed service, adding a rule at the network edge, or raising monitoring.

Accept the risk

1. When a deadline cannot be met, the system owner asks for a documented risk acceptance that states the reason, the compensating controls, and a new date.
2. The ISMS Manager approves the acceptance for High, Medium, and Low. The Management Board must approve it for Critical.

Verify and report

1. After the fix, a new scan confirms that the vulnerability is gone. Only then is the entry closed.
2. Every month the Change Manager reports the open vulnerabilities per rating, the age of the oldest, and the accepted risks to the ISMS Manager.

Records

• The Vulnerabilities register with ratings, deadlines, and closing scans.
• The risk acceptances and their approvals.
• The monthly report.

Related documents

• Secure Development and Change Policy
• Risk Management Policy
• Change Management Procedure

Review

The Change Manager reviews this Procedure at least once a year and after a significant change, and after any vulnerability that was exploited before it was fixed.