2cac8686_plication_Security_and_Privacy__Derived_Security_Controls
Failure to keep software security up to date [Derived Security Controls] 
Create and maintain a policy for software patching Maintain a list of all software, including components (e.g. third-party libraries, frameworks), their versions, source and method of monitoring for security patches and other updates Define who is responsible for the patching of each software component Create, use and maintain a procedure for assessing security patches and other software updates, that includes a risk assessment Apply software security patches in a timely manner Do not use software that is no longer supported by the supplier/vendor/development company; or limit its use and undertake a risk assessment and apply additional controls Create, maintain and operate a process for checking that security patches have been applied to all software components, or those that have not been applied have adequately justified, documented and applied mitigating controls
Privacy : Application Security and Privacy
Derived Security Controls