Explain patch management lifecycle and why timely patching matters in Annex B?

• A. Patching should be done only when a system crashes.
• B. Identify, test, deploy patches; timely patching reduces exploitation risk.
• C. Patch management is optional.
• D. Patches installed automatically without verification.

Answer: (B)

Patch management is about handling security fixes in a structured, ongoing cycle: first identify which systems have vulnerabilities and which patches are available, then assess the risk they pose. Next comes testing patches in a controlled environment to ensure they don’t break critical applications or configurations, followed by planning and deploying them across the production environment. After deployment, you verify that the patches are actually applied and monitor for any issues, updating your records as you go. The cycle repeats as new patches and vulnerabilities emerge, keeping asset inventories and configurations up to date.

Timely patching matters because once a vulnerability is known, attackers can exploit it, often quickly. Reducing the window between patch release and deployment minimizes the chance that a system gets compromised, which protects data, maintains service availability, and supports compliance and risk management goals. Doing patches only after problems occur is reactive and leaves systems exposed; patching without verification can cause instability or compatibility issues, which is why testing and verification are essential steps. Patches that are optional or automated without oversight miss important context about impact and readiness, increasing the likelihood of unintended consequences.