NIST SP 800-40 Rev 4 - Guide to Enterprise Patch Management Planning 3.3: Define the risk response scenarios to be ready for

What does 3.3 require?

Organisations should decide which vulnerability risk response scenarios they must be ready to handle. The guide's four are routine patching (regular release cycles, often neglected because of reboots and interruptions, which widens attackers' windows and makes later emergency patching harder); emergency patching for a severe or actively exploited vulnerability, possibly as part of incident response; emergency mitigation, a temporary measure applied before a patch exists or when a patch is flawed, disruptive or compromised, which may need rolling back later; and unpatchable assets, where isolation or other methods must carry the risk because the vendor supplies no patch or the asset cannot be interrupted.