All externally acquired products and services should be regularly checked for the need of acquiring patches, updates and or upgrades for software and hardware.
These revisions should be acquired only from trusted providers, as well as ensured that the maintenance is only performed by the approved supplier personnel and unauthorized changes are denied.
The provenance, authenticity and integrity of these products and services has to be also confirmed and required by organizational policies and kept intact.
Any compromises in security or need for patches should be reported to leaders and relevant parties promptly.
