[2/27/24, 11:00 AM EST] CSRC has been experiencing technical issues. If you are unable to access a CSRC page or resource, or get a 503 error, please try reloading the page several times--it may help to wait a few minutes before trying again. We apologize for the inconvenience, and hope to have a solution in place next week.
Volume A of the preliminary draft practice guide, Improving Enterprise Patching for General IT Systems, is available for public comment. The National Cybersecurity Center of Excellence (NCCoE) is following an experimental agile process for this practice guide. Instead of posting all volumes at the same time, a preliminary draft of one volume will be posted for comment as work continues on the implementation of the demonstration solution and the development of other parts of the practice guide.
Addressing Patching Challenges
The NCCoE is writing this guide in collaboration with cybersecurity technology providers to identify actionable approaches that can help organizations improve enterprise patching practices for general information technology (IT) systems. Cybersecurity attacks bring home the dangers of operating computers with unpatched software. We know the risks, however, keeping software up-to-date with patches is an ongoing problem for many organizations for a host of reasons including timing and balancing security with mission impact and business objectives.
Future volumes of this guide will include both process and tool usage improvements. Once available, the full practice guide can help your organization improve its security and reduce the likelihood of privacy breaches with sensitive personal information by:
We Value Your Insights
We are seeking your feedback on the proposed approach and example solution outlined in Volume A, which discusses how existing tools can be used to implement:
The solution will also demonstrate recommended security practices for patch management systems themselves.
The public comment period for this document is open through October 9, 2020. See the publication details for a copy of the preliminary draft and instructions for submitting comments.