Creating a Patch and Vulnerability Management Program

Mell, Peter; Bergeron, Tiffany; Henning, David

doi:https://doi.org/10.6028/NIST.SP.800-40ver2

SP 800-40 Version 2

Withdrawn on July 22, 2013. Superseded by SP 800-40 Rev. 3

Creating a Patch and Vulnerability Management Program

Documentation Topics

Date Published: November 2005

Supersedes: SP 800-40 (08/01/2002)

Author(s)

Peter Mell (NIST), Tiffany Bergeron (MITRE), David Henning (Hughes Network Systems)

Abstract

This document provides guidance on creating a security patch and vulnerability management program and testing the effectiveness of that program. The primary audience is security managers who are responsible for designing and implementing the program. However, this document also contains information useful to system administrators and operations personnel who are responsible for applying patches and deploying solutions (i.e., information related to testing patches and enterprise patching software).

Keywords

computer security; security patches; vulnerability management

Control Families

Awareness and Training; Configuration Management; Planning; Risk Assessment

Documentation

Publication:
SP 800-40 Version 2 (DOI)
Local Download

Supplemental Material:
None available

Document History:
11/16/05: SP 800-40 Version 2

Topics

Security and Privacy
patch management; vulnerability management

Applications
enterprise