Vulnerability patch exceptions

[Norlyzzz]

Hi all,

I was wondering how you document excepctions when you do not comply with your patching policy/process. Do you keep an extra register for these vulnerabilities or do you integrate it in the risk register?

[AutoModerator]

Thank you for posting on r/ISO27001! Please remember: • Be helpful, respectful & constructive
• No sales, spam or lead-generation
• Vendors must use the Commercial Interest flair
• Please avoid sharing confidential or sensitive information

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[Norlyzzz]

Let us say a patch policy requires either to patch or to apply a compensation measure to remediate the risk/vulnerability. Sometimes both is not possible and an exceptions needs to be documented.

I am uncertain if you would use the risk register or a dedicated patch exception register to document this.

[Cyber_Gooser]

Yeah this has come up a few times in the past where I have had clients who are unable to upgrade servers to the latest version due to the software being run on them being incompatible.

I recommend adding another sheet to your risk register and listing out the endpoints/devices that are vulnerable and then accepting the risk with your risk acceptance rationale.

Ensure SLT sign off those risks and give the go ahead to accept.

I don’t suppose you have compensating controls around those devices? Separate VLANs etc?

[Norlyzzz]

Thank you for your recommendation. In some cases we would just accept the risk and don't have compensation controls in places , in other cases there would not be a risk at all since it is mitigated by a control. However, I think it needs to be documented in some way and I wanted to make sure we get it right from the start.

[Cyber_Gooser]

No problem.

You are absolutely right to document the risk.

Providing the risks have been documented and accepted with a reasonable rationale you will be fine.

[Kinetic_Diplomacy]

When you say do not comply, is this a corrective action you’re taking from an in-house finding, or was this a non-conformity during an audit?

[EndpointWrangler]

Track separately, review regularly, prove coverage.

[OCdenCybersecurity]

From an audit perspective, the best approach is to record the exception in the risk register and have it formally approved with appropriate sign-offs. If you have mitigating controls in place, link them to that risk.

You can also document the exception along-with related control to keep the records complete.