Policy Register

Patch management policy

The deadlines for applying security updates by severity and system class, the testing before them and the exceptions process.

How the register reads it

Also calledpatching policy, security updates
FamilyOperations and technology
Document typePolicy. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Folds intoThe regimes accept it folded into the vulnerability management policy; when neither is listed, the gap is counted once, under the parent.
Expected ownerThe head of IT operations.
Review cadenceAnnual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list whennever on its own: the register recognises it and names the clauses, but no ticked regime lists it as a separate document (its parent, vulnerability management policy, is).
TemplatePatch management policy.

Which standards require it, and what each expects it to contain

1 requiring clauses, 1 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 8.8 Management of technical vulnerabilities

Obtain vulnerability information, evaluate exposure, and take appropriate remediation.

What the ISO 27002 guidance expects the document to say: Requires information about technical vulnerabilities in the information systems in use to be obtained, the organisation's exposure to them to be evaluated, and appropriate measures to be taken. Older source material sets out the surrounding process: named roles and responsibilities, identified information sources, a defined reaction timeline, assessment of the risk posed by the vulnerability against the risk of applying the patch, testing before deployment, alternative measures where no patch exists, an audit log of actions taken, and highest risk systems addressed first.

Evidence an auditor accepts: Defined roles and information sources for vulnerability identification, and the asset scope they cover; scan results and vulnerability inventory for the period, with authenticated scanning where applicable; the defined reaction timeline by severity, and measurement of actual remediation against it
Common gap: Relying on ad-hoc scans only
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Network security policy · Physical security policy