FFIEC IT Examination Handbook AIO-VI.B.3(b): VI.B.3(b) Patch Management (Architecture, Infrastructure, and Operations)

Management runs a patch management program that documents patch installations under change management, implements automated patch management so that servers, virtual machines, routers, switches, mobile devices and firewalls are updated, keeps a record of the versions in place, monitors the internet and other resources for enhancements, security issues, patches and upgrades to inventoried software, integrates its patching with third-party providers' patches and changes, and in cloud environments may rebuild rather than patch through a highly automated process.