Vulnerability and Patch Management Policy template (SOC 2)

1. Purpose

Every system Northwind Cloud Inc runs will eventually contain a known vulnerability, because new weaknesses are published daily in operating systems, libraries, images and cloud services. A sound program is measured not by the absence of vulnerabilities but by how quickly they are found, how sensibly they are prioritized and how reliably they are fixed. This policy defines the discovery sources, severity ratings, remediation timelines, exception handling and verification that Northwind Cloud Inc applies across Northwind and its environment, supporting the SOC 2 criteria for identifying and monitoring vulnerabilities and configuration changes.

2. Scope

This policy applies to all technology assets Northwind Cloud Inc owns or operates: production and non-production environments on AWS and Vercel, container and machine images, application code and dependencies for Northwind in GitHub, runners used by GitHub Actions, laptops and mobile devices managed with Kandji, network and identity configuration in Okta, and SaaS configuration for Supabase, Stripe, Datadog and Slack to the extent Northwind Cloud Inc controls it. It binds all employees and contractors who own, administer or develop these assets.

3. Roles and Responsibilities

• Executive Management approves this policy, funds scanning tooling and the annual penetration test, receives monthly vulnerability reporting and approves risk acceptance for Critical and High findings that miss their timeline.
• Security Owner (Dana Whitfield, CTO) owns the vulnerability register, confirms severity ratings, chairs weekly triage, approves exceptions, monitors threat intelligence and vendor advisories, coordinates the penetration test and reports metrics.
• Engineering operates the scanning tools, triages findings in its systems, applies patches and fixes through the Change Management Policy, rebuilds images on schedule, remediates cloud misconfigurations and verifies closure.
• People Operations ensures personnel keep devices updated, supports enforcement of endpoint patch compliance and records related training.
• All Personnel install operating system and browser updates promptly, never disable automatic updates or endpoint agents, and report suspected vulnerabilities to security@northwindcloud.example.

4. Policy Statements

• 4.1 Northwind Cloud Inc maintains continuous discovery across in-scope assets from at least these sources: software composition and static analysis in GitHub Actions on every pull request and on a schedule; secret scanning in GitHub; container image scanning before deployment and on a recurring schedule; the native security posture service of each platform in AWS and Vercel; endpoint patch and compliance reporting from Kandji; an annual independent penetration test; vendor advisories; published threat intelligence including the CISA Known Exploited Vulnerabilities catalog; and reports received through the disclosure channel.
• 4.2 Findings are rated Critical, High, Medium or Low starting from the CVSS base score (9.0 and above Critical, 7.0 to 8.9 High, 4.0 to 6.9 Medium, below 4.0 Low) and adjusted for Northwind Cloud Inc's context: internet exposure, reachability in Northwind, active exploitation and data sensitivity. Any vulnerability in the CISA Known Exploited Vulnerabilities catalog present in an internet-facing system is Critical. The Security Owner may adjust a rating with recorded justification.
• 4.3 Findings are remediated within timelines measured from detection: Critical within 7 days, High within 30 days, Medium within 90 days, and Low within 180 days or at the next scheduled maintenance, whichever is sooner. Where no fix exists for a Critical finding in an internet-facing system, a mitigating control such as a firewall rule, feature disablement or configuration change is applied within 72 hours.
• 4.4 Patching follows a defined cadence: production container and machine images are rebuilt from updated bases and redeployed at least monthly; managed services on AWS and Vercel rely on provider patching with Northwind Cloud Inc tracking maintenance notices; and endpoints install operating system and browser security updates within 14 days of release with automatic updates enforced through Kandji. Devices non-compliant for more than 14 days are blocked from company systems until remediated.
• 4.5 All findings from every source are tracked in a single vulnerability register with asset, severity, source, owner, detection date, due date, status and closure evidence. A finding closes only when the fix is verified by rescan, retest or documented review.
• 4.6 Where a finding cannot be remediated on time, the owner submits an exception with the reason, compensating controls and planned remediation date. The Security Owner approves exceptions for Medium and Low findings; Critical and High exceptions also require Executive Management approval. Exceptions last no more than 90 days and are re-reviewed before renewal.
• 4.7 Northwind Cloud Inc publishes a security contact at security@northwindcloud.example and a security.txt file, acknowledges good-faith reports within three business days, works with reporters to validate and fix issues, and does not pursue legal action against researchers who act in good faith, respect user privacy and avoid service disruption.
• 4.8 Vulnerabilities disclosed in vendor services, including Supabase, Stripe, Datadog and Slack, are assessed for impact within the same timelines as internal findings, and vendor responses are tracked under the Vendor and Third-Party Risk Management Policy.
• 4.9 When a zero-day or widely exploited vulnerability affecting an in-scope component is announced, the Security Owner convenes Engineering the same business day to assess exposure, apply mitigations and communicate status. Confirmed exploitation of Northwind Cloud Inc systems is handled under the Incident Response Policy.
• 4.10 Internet-facing systems are scanned at least quarterly and after significant changes, in addition to continuous pipeline scanning.
• 4.11 End-of-life or unsupported software is not used in production. Engineering tracks support end dates for operating systems, runtimes, databases and major frameworks and begins migration at least 90 days before support ends.
• 4.12 Penetration test findings enter the register at the tester's severity, adjusted under 4.2 where warranted, are remediated within the 4.3 timelines, and Critical and High findings are retested by the tester before closure. The Security Owner reports monthly to Executive Management on open findings by severity, the percentage remediated on time, overdue items and active exceptions.

5. Procedures

• 5.1 Continuous scanning. Engineering configures each source in 4.1 to run automatically and route findings into the register or a designated alert channel, and confirms weekly that every source produced results in the past seven days. A source that stops reporting is a High finding against the scanning system itself.
• 5.2 Triage. Within two business days of detection the Security Owner or delegate confirms or adjusts severity, assigns an owner and due date, and marks false positives with written justification. Weekly triage reviews all open Critical and High findings and anything approaching its due date.
• 5.3 Remediation. The owner fixes the finding through a pull request in GitHub that references the register entry and is deployed under the Change Management Policy; Critical findings in internet-facing systems may use the emergency change procedure. The register entry links to the merged change and deployment record.
• 5.4 Monthly patch cycle. In the first week of each month Engineering updates base images, rebuilds and redeploys production services, applies pending updates to long-lived hosts, reviews the endpoint compliance report from Kandji and remediates or blocks non-compliant devices, producing a record of what was updated and any deferrals.
• 5.5 Cloud posture review. Each week Engineering reviews new findings from the native security posture service of each platform in AWS and Vercel. Public storage, security groups open to the internet on administrative ports, identities without multi-factor authentication, disabled logging and unencrypted data stores are rated High or Critical and fixed within 7 days.
• 5.6 Penetration test. The Security Owner engages an independent tester annually, scopes Northwind (Web SaaS) and its infrastructure, provides accounts and documentation, enters findings into the register, tracks remediation and obtains a retest letter for Critical and High findings; the report and letter are retained as audit evidence.
• 5.7 Disclosure handling. Reports to security@northwindcloud.example are acknowledged within three business days, reproduced and rated, tracked in the register and remediated within the standard timelines; the reporter is updated at triage and at resolution and credited with consent.
• 5.8 Exceptions and closure. Exception requests are submitted through the register, evaluated by the Security Owner for compensating controls, approved as required and entered in the exception register with an expiry of at most 90 days, remaining visible in reporting as accepted risk. Before closing any finding the owner attaches evidence such as a clean rescan, retest result, deployment record or dated configuration screenshot; the Security Owner spot-checks closures monthly and reopens any lacking evidence.
• 5.9 Reporting. The Security Owner produces the monthly report described in 4.12 and, at each annual policy review, summarizes trends, tool coverage gaps and process changes for Executive Management.

6. Exceptions

Deviations beyond the finding-level exceptions in 4.6, such as an asset that cannot be scanned or a patch cadence that cannot be met for a specific system, require a written exception request describing the system, the risk, the compensating controls and the remediation date. The Security Owner approves or rejects it; exceptions affecting internet-facing or customer-data systems also require Executive Management approval. Approved exceptions are recorded in the exception register, last no more than 12 months and are reviewed at each policy review.

7. Enforcement

Ignoring assigned findings, disabling scanners or endpoint updates, or deploying known-vulnerable components outside an approved exception violates this policy and is handled under the Human Resources Security Policy, which may result in disciplinary action up to and including termination of employment; contractors and vendors are subject to contract termination. Suspected exploitation of any vulnerability is reported immediately to security@northwindcloud.example under the Incident Response Policy.

8. Review Cadence

The Security Owner reviews this policy on the annual review cycle and after any significant change to Northwind Cloud Inc's technology stack, scanning tools or cloud platforms, and after any incident involving an unpatched vulnerability. Changes are approved by Priya Natarajan, CEO and recorded in the revision history.

9. Revision History