Vulnerability & Patch Management Programme

What this set does

Patching is where most organisations fail Cyber Essentials, PCI DSS and 800-171 assessments, not because they do not patch but because they cannot show the rule they patch against. This programme defines remediation timelines by severity and exposure, and gives you the exception process for when you cannot meet them.

What's inside

• Vulnerability management policy and remediation SLA standard
• Scanning procedure (authenticated, external, web application)
• Patch management procedure with maintenance windows and rollback
• Exception and risk-acceptance procedure with register
• Secure baseline configuration standards: Windows, Linux, macOS, network devices, cloud (AWS, Azure, Microsoft 365)
• Monthly vulnerability report template

Who it is for

IT and security teams that need documented timelines and a defensible exception process.

How the documents are structured

Every document opens with its purpose, scope and owner, then the substantive content, then a control cross-reference showing which framework requirements it satisfies. Standards state requirements in testable language ("must", with the parameter). Procedures follow one format: trigger, roles, steps, frequency, records produced. Placeholders are limited to things only you can know: organisation name (which we fill in), system names, role titles, tool names and timelines. There are no "[insert policy here]" sections.

Tailoring effort

Expect to spend a few hours on a policies-and-standards set and longer on procedures, because procedures describe how your team actually works. The document register in each set lists every file with a suggested owner so you can split the work.

Included in these bundles

• NIST 800-171 & CMMC Level 2 Bundle — £1,995

Licence

One purchase covers one organisation for internal use, with unlimited users and unlimited edits. Consultancies and MSPs tailoring documents for clients need the multi-client licence; see the terms or ask us.