Perform Automated Operating System Patch Management

The organization has defined a process for addressing identified technical vulnerabilities.

Some vulnerabilities can be fixed directly, but vulnerabilities that have a significant impact should also be documented as security incidents. Once a vulnerability with significant impacts has been identified:

• risks related to the vulnerability and the necessary actions are identified (e.g. patching the system or other management tasks)
• necessary actions are scheduled
• all actions taken are documented

The organisation should have an adequate patch management procedure defined and implemented. This should include the testing and installation of patches.

There should measures to minimize the risk related to patch management and verification of successful installation of patches.

The patch management should be automated when possible (for example operating system updates).

The patch management process should take into account the requirements set by frameworks or other requiremetns they need to comply with.