GOOD PRACTICE GUIDE

This paper was previously published by the National Infrastructure Security Co-ordination Centre (NISCC) – a predecessor organisation to the Centre for the Protection of National Infrastructure (CPNI). Hyperlinks in this document may refer to resources that no longer exist. Please see CPNI’s website (www.cpni.gov.uk) for up-to-date information. This paper provides a guide to Critical National Infrastructure organisations on Patch Management. It describes a four-stage process for ensuring that all systems are appropriately patched to minimise security vulnerabilities, and describes a system of metrics that organisations may use for measuring the effectiveness of their patching strategy. Finally, it gives some specific details on patching tools for common operating systems. Disclaimer Reference to any specific commercial product, process or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favouring by CPNI. The views and opinions of authors expressed within this document shal