The VP of IT is responsible for providing a secure network environment for {COMPANY-NAME}. It is {COMPANY-NAME}’s policy to ensure all computer devices (including servers, desktops, printers, etc.) connected to {COMPANY-NAME}’s network, have the most recent operating system, security, and application patches installed.
Every user, both individually and within the organization, is responsible for ensuring prudent and responsible use of computing and network resources.
IT is responsible for ensuring all known and reasonable defenses are in place to reduce network vulnerabilities while keeping the network operating.
IT Management and Administrators are responsible for monitoring security mailing lists, reviewing vendor notifications and Web sites, and researching specific public Web sites for the release of new patches.
Monitoring will include, but not be limited to:
- Scheduled third-party scanning of {COMPANY-NAME}’s network to identify known vulnerabilities
- Identifying and communicating identified vulnerabilities and/or security breaches to {COMPANY-NAME}’s VP of IT
- Monitoring Computer Emergency Readiness Team (CERT), notifications, and Web sites of all vendors that have hardware or software operating on {COMPANY-NAME}’s network
The IT Security and System Administrators are responsible for maintaining the accuracy of patching procedures which detail the what, where, when, and how to eliminate confusion, establish a routine, provide guidance, and enable practices to be auditable.
Documenting the implementation details provides the specifics of the patching process, which includes specific systems or groups of systems and the timeframes associated with patching.
Once alerted to a new patch, IT Administrators will download and review the new patch. The patch will be categorized by criticality to assess the impact and determine the installation schedule.
