2.3 KiB
Title: Vulnerability and Patch Management Policy Document ID: [POL-VULN-001] Version: 0.1 Draft Status: Draft Owner: CISO (Paul Jenkins) Approver: CEO (Paul Hague) Classification: Internal Effective date: [DD Month YYYY] Review date: [DD Month YYYY]
Vulnerability and Patch Management Policy
Purpose
This policy defines BlackDice's expectations for identifying, assessing, prioritising, remediating, and tracking vulnerabilities and security patches.
Scope
This policy applies to applications, cloud infrastructure, containers, Kubernetes components, endpoints, dependencies, and third-party software within the ISMS scope.
Objectives
- reduce exposure to known vulnerabilities
- apply patches and remediation actions within risk-based timeframes
- maintain visibility of unresolved security weaknesses
Principles / Policy Statements
BlackDice must maintain processes to identify vulnerabilities affecting in-scope systems and services.
Vulnerabilities and missing security patches must be assessed according to business context, exploitability, exposure, and potential impact.
Production-facing cloud workloads, externally exposed services, CI/CD components, and identity systems should receive prioritised remediation attention.
Where immediate remediation is not possible, compensating controls, formal risk acceptance, or time-bound exceptions must be considered and recorded.
Remediation activity must be tracked to closure and supported by appropriate evidence.
Roles and Responsibilities
- [Role] must oversee vulnerability management requirements.
- System and service owners must remediate issues affecting their assets.
- Management must support prioritisation where remediation requires planned change or resource allocation.
Compliance / Exceptions
Deferred remediation must be justified, recorded, approved where required, and reviewed until closure.
Monitoring and Review
This policy should be monitored through vulnerability reporting, patch timeliness, exception tracking, incidents, and audit findings.
Related Documents
- Information Security Policy
- Vulnerability Management Procedure
- Patch Management Procedure
- Secure Configuration Standard
Version Control
| Version | Date | Description of Change | Author |
|---|---|---|---|
| 0.1 Draft | [DD Month YYYY] | Initial draft. | [Name or Role] |