Requirement 6.2 follows on from vulnerability management
and requires that you should patch vulnerabilities once
the vendor releases a patch.
The requirement is simple, that vendor-supplied patches need to be installed,
period, and when the patch fixes a critical vulnerability,
it should be installed within a month, and remember,
this is your definition of the critical vulnerability; we
should also include the environmental score relating to the
criticality or importance of the assets.
Now,
although the standard says you should patch critical
vulnerabilities within 30 days, please don't wait this long.
My advice is that you patch critical vulnerabilities much sooner than this.
The QSA is going to look at your policies,
but also check actual systems to validate the patches that your policy
says should have been applied have actually been applied.
Typically,
the QSA is going to look at systems that can show records of
you making the risk assessment and then look through
historical change control records.
So look,
if you've got a centralized system that pushes
patches out to systems in the CDE, which I guess most people do nowadays,
the QSA is going to look at that patch management and patch pushing system.
Now we're going to join the discussion between Jacob and me where
we discuss some of the typical problems in vulnerability
management and to what extent it affected the breaches of
cardholder data that we've both seen.