GRCLibrary.ai

Procedure

Patch Management Procedure

This procedure defines the end-to-end process for identifying, classifying, testing, authorizing, deploying, and verifying security patches and software updates across the organization's technology estate. It operationalizes the patch remediation SLAs established in the Production Security Requirements Standard and the Vulnerability Management Procedure, translating policy obligations into repeatable operational steps.

Type
Procedure
Version
1.0.29
Date
2026-10-27
Owner
IT Operations Lead
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Operations Security
Review frequency
Annual and upon material threat, framework, or regulatory change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • Purpose
  • Scope
  • Governance and accountability
  • 1. Patch classification
  • 2. Patch testing
  • 3. Deployment authorization
  • 4. Exceptions and deferrals
  • 5. End-of-life system management
  • 6. Third-party and open-source library patching
  • 7. Monitoring and reporting
  • 8. Evidence retention
  • Framework alignment

Frameworks it maps to

Related documents