2.0 OCIO Vulnerability Patch Strategy Vulnerability Risk Examples (*If CVSS ISB Patching Rating criteria is met apply Recommendation patches as required) EXTREME (Critical) Vulnerability allows 10 Within 48 Hours remote code execution *Formal acceptance of risk is required for Critical business all instances in system/information which patching affected cannot be completed during Exploits exist and the recommended are in use time frame System is connected to the Internet without having mitigating controls in place HIGH (Important) Vulnerability allows 7.0 9.9 Within 14 – remote code **PCI-DSS Calendar Days execution Systems with a score of 6.0 or *Formal acceptance Critical business of risk is required for higher follow this system information all instances in standard** affected which patching Exploits exist and cannot be are in use completed during the recommended The system is in a time frame protected enclave with strong access controls MEDIUM Vulnerability allows 4.0 6.9 – an attacker to impersonate a legitimate user on a remote access solution System is exposed to unauthenticated users
2.0 OCIO Vulnerability Patch Strategy Vulnerability Risk Rating Examples (*If criteria is met apply patches as required) CVSS ISB Patching Recommendation EXTREME (Critical) Vulnerability allows remote code execution 10 Within 48 Hours *Formal acceptance of risk is required for all instances in which patching cannot be completed during the recommended time frame Critical business system/information affected Exploits exist and are in use System is connected to the Internet without having mitigating controls in place HIGH (Important) Vulnerability allows remote code execution 7.0 – 9.9 **PCI-DSS Systems with a score of 6.0 or higher follow this standard** Within 14 Calendar Days *Formal acceptance of risk is required for all instances in which patching cannot be completed during the recommended time frame Critical business system information affected Exploits exist and are in use The system is in a protected enclave with strong access controls MEDIUM Vulnerability allows an attacker to impersonate a legitimate user on a remote access solution 4.0 – 6.9 System is exposed to unauthenticated users
patch_standard_v1.docx