What is required regarding patching known vulnerabilities?

What is required regarding patching known vulnerabilities?

• A. Install critical security patches within one month of release.
• B. Install all security patches within seven days of release.
• C. Patches are optional for non-critical systems.
• D. Patches must be tested but may not be applied immediately.

Answer: (A)

Patching known vulnerabilities is handled through a defined patch management process aimed at reducing exposure to security flaws. In PCI DSS, critical security patches must be installed within one month of their release. This one-month window ensures rapid remediation of the most dangerous flaws while allowing for proper testing and controlled deployment. The other options don’t fit because seven days for all patches is not required, patches aren’t optional for non-critical systems, and while testing is important, delaying beyond the stated window for critical patches isn’t aligned with the required timeframe.

Patching known vulnerabilities is handled through a defined patch management process aimed at reducing exposure to security flaws. In PCI DSS, critical security patches must be installed within one month of their release. This one-month window ensures rapid remediation of the most dangerous flaws while allowing for proper testing and controlled deployment. The other options don’t fit because seven days for all patches is not required, patches aren’t optional for non-critical systems, and while testing is important, delaying beyond the stated window for critical patches isn’t aligned with the required timeframe.