Study. uk . com
  1. Home
  2. All questions
  3. Question 587

CISM study material · question 587 of 1000

Which three steps does NIST describe for patch management within the configuration process?

  1. Scanning, prioritising and reporting
  2. Downloading the fixes as soon as they are published, deploying them across the whole of the estate on a fixed schedule, and documenting what was applied where
  3. Capturing relevant fixes as vendors release them, testing their implementation for adverse effects, and implementing them if testing supports it
  4. Requesting, approving and scheduling
Show the answer

Answer: C. Capturing relevant fixes as vendors release them, testing their implementation for adverse effects, and implementing them if testing supports it

SP 800-100 keeps agencies alert for every relevant fix as it is released, has them test what implementing it does, and deploy only where the testing supports doing so.

Source: NIST SP 800-100 (NIST) — Sec. 14.3 Step 5 Continuous Monitoring

Challenge yourself on this topic → Study as cards