Citation Tagging

Citation Reference: 2.2.3. Fundamental response measures (3)

Citation Guidance: Organizations should establish deadlines for implementing patches and other remedial measures based on the criticality of systems, the level of risk, and the severity of vulnerabilities, and should maintain records of implementation status. (For systems with high-risk configurations—such as those lacking network segmentation between business and internet-facing environments—patch impact assessments should be conducted, and patches should be applied either promptly or within a defined timeframe.) In cases where patching or other remedial actions are exceptionally not carried out, formal approval must be obtained from senior management, etc., along with a documented assessment of the associated risks.