PCI SSCPCI DSSVulnerability MgmtEASYFree question
What does PCI DSS require for patch management?
- A.Critical security patches must be installed within one month of release, and all applicable vendor-supplied security patches must be installed in a timely manner
- B.Critical patches must be installed within 72 hours of release, and all other patches must be deployed during the next annual maintenance window agreed with the acquiring bank
- C.High-risk patches must be installed within 90 days of the vendor's release, and all remaining patches must be bundled into the quarterly ASV scan remediation cycle
- D.Only patches for the CDE operating system must be installed within one month of release, and all application and database fixes are exempt from patching under a compensating control
Why A is correct
Critical security patches must be installed within one month of release. All security patches should be applied in a timely manner based on risk.
Know someone studying for PCI DSS? Send them this one.