| Organizations are required to identify information systems containing software affected by recently announced software flaws (and potential vulnerabilities resulting from those flaws) and report this information to designated organizational officials with information security responsibilities (e.g., senior information security officers, information system security managers, information systems security officers). To support this requirement, an automated process or mechanism is required.
This role is usually assigned to patch management software that is deployed in order to track the number of systems installed in the network, as well as the types of software installed on these systems, the corresponding versions, and the related flaws that require patching. The requirement is NA. The AS does not provide a patch management capability. |
