Patch and configuration
The figure most frameworks actually ask for: patched within SLA.
Patch management
Patch state with classification, priority and SLA tracking, imported from CSV or a connected source. Coverage (the share of the estate patched within its SLA) is a headline tile rather than something you calculate for the audit.
Key capabilities
- Patch classification and priority
- SLA tracking with coverage reporting
- Import from CSV and connected scanners
- Links from patches to assets and vulnerabilities
Configuration management (CMDB)
A configuration-item register with a graph of how items relate. Import from CSV to get started, then keep the links that let a change request show its blast radius, so you answer "what else does this touch" before a change rather than after an incident.
Key capabilities
- Configuration items with attributes and relationships
- Configuration-item graph
- CSV import and bulk update
- Links to assets and changes
Proof point
Coverage is the figure most frameworks actually ask for: the share of the estate patched within its SLA. It is a headline tile, not a spreadsheet you build the week before the audit.
Questions about this module
What patch deadlines do frameworks require?
Cyber Essentials requires critical and high-risk updates within 14 days. Essential Eight Maturity Level 2 requires 48 hours for exploited vulnerabilities in internet-facing services. SOC 2 and ISO 27001 require a documented policy you can prove you follow.
Do we need agents on every server?
No. Cloud and container scanning is API-based; endpoint status comes from your existing endpoint protection or MDM integration.
How is a baseline approved?
The baseline is a versioned record with an approver and date. Changes to it go through change management, so the approval trail is complete.