65 lines
2.3 KiB
Markdown
65 lines
2.3 KiB
Markdown
Title: Vulnerability and Patch Management Policy
|
|
Document ID: [POL-VULN-001]
|
|
Version: 0.1 Draft
|
|
Status: Draft
|
|
Owner: CISO (Paul Jenkins)
|
|
Approver: CEO (Paul Hague)
|
|
Classification: Internal
|
|
Effective date: [DD Month YYYY]
|
|
Review date: [DD Month YYYY]
|
|
|
|
# Vulnerability and Patch Management Policy
|
|
|
|
## Purpose
|
|
|
|
This policy defines BlackDice's expectations for identifying, assessing, prioritising, remediating, and tracking vulnerabilities and security patches.
|
|
|
|
## Scope
|
|
|
|
This policy applies to applications, cloud infrastructure, containers, Kubernetes components, endpoints, dependencies, and third-party software within the ISMS scope.
|
|
|
|
## Objectives
|
|
|
|
- reduce exposure to known vulnerabilities
|
|
- apply patches and remediation actions within risk-based timeframes
|
|
- maintain visibility of unresolved security weaknesses
|
|
|
|
## Principles / Policy Statements
|
|
|
|
BlackDice must maintain processes to identify vulnerabilities affecting in-scope systems and services.
|
|
|
|
Vulnerabilities and missing security patches must be assessed according to business context, exploitability, exposure, and potential impact.
|
|
|
|
Production-facing cloud workloads, externally exposed services, CI/CD components, and identity systems should receive prioritised remediation attention.
|
|
|
|
Where immediate remediation is not possible, compensating controls, formal risk acceptance, or time-bound exceptions must be considered and recorded.
|
|
|
|
Remediation activity must be tracked to closure and supported by appropriate evidence.
|
|
|
|
## Roles and Responsibilities
|
|
|
|
- [Role] must oversee vulnerability management requirements.
|
|
- System and service owners must remediate issues affecting their assets.
|
|
- Management must support prioritisation where remediation requires planned change or resource allocation.
|
|
|
|
## Compliance / Exceptions
|
|
|
|
Deferred remediation must be justified, recorded, approved where required, and reviewed until closure.
|
|
|
|
## Monitoring and Review
|
|
|
|
This policy should be monitored through vulnerability reporting, patch timeliness, exception tracking, incidents, and audit findings.
|
|
|
|
## Related Documents
|
|
|
|
- Information Security Policy
|
|
- Vulnerability Management Procedure
|
|
- Patch Management Procedure
|
|
- Secure Configuration Standard
|
|
|
|
## Version Control
|
|
|
|
| Version | Date | Description of Change | Author |
|
|
| --- | --- | --- | --- |
|
|
| 0.1 Draft | [DD Month YYYY] | Initial draft. | [Name or Role] |
|