How should patch management be implemented to align with Annex F?

• A. Patch strategy should be managed on a monthly basis with no testing.
• B. Patches should be deployed only after approval.
• C. Timely identification and deployment of critical patches, testing, rollback plan, and evidence of compliance.
• D. Patches should be avoided.

Answer: (C)

The essential idea here is that patch management must be proactive and controlled to reduce risk, with a clear lifecycle that includes timely action, verification, and evidence for audits. The best option emphasizes identifying critical patches quickly, deploying them promptly, testing before broad rollout to avoid breaking systems, having a rollback plan if something goes wrong, and keeping evidence of compliance. This combination ensures vulnerabilities are remediated fast while preserving stability and providing auditable proof that controls are in place and functioning.

Patching only on a monthly schedule without testing leaves gaps and uncertainty about compatibility, defeating the goal of safe, timely remediation. Relying on approvals alone can introduce delays and does not guarantee the patches are actually applied when needed. Avoiding patches entirely is contrary to any security standard.