text: Patch Management Policy and Procedure - Liaison
  1. End-users computers
  2. Corporate and IT servers and network devices
  3. QA, Integration, Development
  4. Preproduction, Demo and staging
  6. Zero-day and emergency security patching:
  Patch-Compliance Review Procedure
  Security Patching Workflow
  Review and approve changes to the Patch Management Policy and Procedures
  IT Director and the CFO
  Scan for patches (Vulnerability Management Program)
  Obtain patches for systems
  Notify teams (QA, DEV, pre-prod and production) of patching schedules (depending on environment)
  Test services after patching
  QA/Dev Engineer
  Notify and report testing results
  Remediate issues, as necessary
  QA/Dev Engineer / IT Systems engineer / IT Security team
  Download necessary patches from a trusted source (as made available)
  Patches are approved, deployed, and applied in staging
  Create a change management request one week before the maintenance date
  The Customer Support team posts a maintenance window on customers' portal
  Communicate extended outages to appropriate teams. If outage goes past window, Customer Support must communicate it to customers
  Note: The Security team will determine the risk and the relevance of the patch, as well as when the system should be patched.
  Create a change management request before the maintenance date
  Systems or applications that cannot be patched to resolve a known vulnerability will have the justification documented by the device/application owner and the necessary compensating control(s) implemented:
  Patch provided by vendor creates instability within the system; instability outweighs the risk.
  Systems that transmit or store protected data and cannot be patched to resolve a known vulnerability will be brought to the attention of the data owner (typically the IT Security manager, IT Director, and the department Director) and the necessary compensating control(s) will be implemented.
  The IT Security team will generate and review patch management/compliance reports on at least a monthly basis from the company vulnerability management tools.
  In reviewing the patch reports, The IT Security team will identify unpatched machines that connect to the company network and either patch or define an exception.
  IT security will conduct an external vulnerability scan on at least a monthly basis using Nessus to identify known and potential vulnerabilities with the publicly facing system. Vulnerabilities will be brought to the attention of the system/application administrator(s) for mitigation.