Patch Management Policy
Version 1.3
For Students, Faculty, Staff, Guests, Alumni
Purpose
The purpose of this policy is to establish requirements for timely, risk-based patching and related security updates for University-owned or managed IT Resources.
Scope
This IT security policy, and all policies referenced herein, shall apply to all members of the University community, including faculty, students, administrative officials, staff, alumni, authorized guests, delegates, and independent contractors (the “User(s)” or “you”) who use, access, or otherwise employ, locally or remotely, the University’s IT Resources, whether individually controlled, shared, stand-alone, or networked.
Policy Statement
- All IT Resources must be part of a Patch Management Cycle that identifies applicable patches and security-relevant updates and ensures the assessment, remediation, and verification of IT Resources under their management or supervision.
- All security-relevant patches, firmware updates, and patch-related configuration changes must be assessed, prioritized, and deployed to University-owned or managed IT Resources within the timeframes established by the Vulnerability Management Procedure.
- Patches and patch-related configuration changes must be tested, documented, and approved in accordance with the Change Management Policy before deployment to IT Resources.
- Emergency or unscheduled changes must follow the applicable change process.
- Patches and security-relevant updates must be obtained from authorized or trusted sources. Where vendor-provided hashes, digital signatures, or other integrity-verification mechanisms are available, they must be used to verify authenticity and integrity before deployment.
- Information Security and Assurance (ISA) and responsible IT personnel must monitor relevant vendor notifications, vulnerability information, security alerts, and advisories, and take appropriate action to evaluate, prioritize, and deploy applicable patches or updates.
- Patch status, missing updates, deployment failures, and unauthorized changes associated with patching must be monitored using University-approved tools where technically supported.
- Identified issues must be investigated and remediated.
- IT Resources that cannot be patched within required timeframes must follow the Patching Exception Policy and Patch Management Exception Procedure. Approved exceptions must include documented risk review and compensating controls as required.
- Patch management records, including assessment, testing, approvals, deployment status, exceptions, and corrective actions, must be maintained and retained.
Definitions
IT Resources include computing, networking, communications, applications, and telecommunications systems, infrastructure, hardware, software, data, databases, personnel, procedures, physical facilities, cloud-based vendors, Software as a Service (SaaS) vendors, and any related materials and services.
A patch is a software update comprised of code inserted (i.e., patched) into the code of an executable program. Typically, a patch is installed into an existing software program. Patches are often temporary fixes between full releases of a software package. Patches include, but are not limited to the following:
- Updating software
- Fixing a software bug
- Installing new drivers
- Addressing new security vulnerabilities
- Addressing software stability issues
Patch management cycle is the documented process for identifying, assessing, prioritizing, testing, approving, deploying, verifying, and tracking applicable patches and security-relevant updates within specified timeframes.
Security-relevant update means a software, firmware, signature, definition, or configuration update intended to correct or mitigate a security weakness or maintain security protections.
NIST SP 800-53 Rev. 5 Alignment
System and Information Integrity: SI-2 Flaw Remediation; SI-3 Malicious Code Protection; SI-4 System Monitoring; SI-5 Security Alerts, Advisories, and Directives; SI-7 Software, Firmware, and Information Integrity.
Related Policies and Procedures
- Change Management Policy
- Patching Exception Policy
- Patch Management Exception Procedure
- Vulnerability Management Policy
- Vulnerability Management Procedure
Implementation Information
| Review Frequency: | Triennial |
|---|---|
| Responsible Person: | Senior Director, IT Security Operations and Assurance |
| Approved By: | CISO |
| Approval Date: | March 1, 2017 |
Revision History
| Version | Date | Description |
|---|---|---|
| 1.0 | 01/23/2017 | Initial policy |
| 1.1 | 01/29/2019 | Updated policy statement |
| 1.2 | 05/10/2020 | Updated purpose and policy statements |
| 1.3 | 08/02/2023 | Updated definitions |
| 2.0 | 08/26/2026 | Incorporated NIST.SP 800-53 r5 controls: SI-2, SI-3, SI-4, SI-5, SI-7, SI-12 into the policy statement and added patch exception references. |
Policy Disclaimer Statement
Deviations from policies, procedures, or guidelines published and approved by Information Security and Assurance (ISA) will only be considered cooperatively between ISA and the requesting entity with sufficient notice to allow for conducting appropriate risk analysis, documentation, review, and notification to authorized University representatives where necessary. Failure to adhere to ISA written policies may be met with University sanctions up to and including dismissal.