Patch Management

 Interagency Guidelines Establishing Information Security Standards Small-Entity Compliance Guide

I. INTRODUCTION

Purpose and Scope of the Guide

This Small-Entity Compliance Guide¹ is intended to help financial institutions² comply with the Interagency Guidelines Establishing Information Security Standards (Security Guidelines).³ The guide summarizes the obligations of financial institutions to protect customer information and illustrates how certain provisions of the Security Guidelines apply to specific situations. The appendix lists resources that may be helpful in assessing risks and designing and implementing information security programs.

Although this guide was designed to help financial institutions identify and comply with the requirements of the Security Guidelines, it is not a substitute for the Security Guidelines. Moreover, this guide only addresses obligations of financial institutions under the Security Guidelines and does not address the applicability of any other federal or state laws or regulations that may pertain to policies or practices for protecting customer records and information.

 Guidance on Developing an Information System

Guidance on Developing an Information System
Patch Management Program to Address Software Vulnerabilities

Introduction

As financial institutions become increasingly dependent on commercial software to support critical business processes, they also increase their exposure to software vulnerabilities. Most financial institutions use multiple commercial software packages. Therefore, it can be challenging to identify, test, and install all of the applicable patches that are necessary to maintain each software package.

A patch management program should be part of an institution's overall computer security program. Oversight and accountability should be assigned to an appropriate party; however, the patch management program should include management, information security, and systems operations personnel. Consumer privacy regulations require that periodic risk assessments be provided to the Board of Directors.