Patching Clause Samples

Patching. The Contractor must patch all Systems regularly in line with security best practices and ensure that current software, operating systems and application patching levels are maintained. The Contractor must ensure that all Systems have all patches installed on a regular schedule, within the time frame recommended by the manufacturer unless the Province otherwise consents in writing. The Contractor must ensure that vulnerabilities are remedied and patches installed on an accelerated basis for zero-day, critical and high vulnerabilities. For zero-day vulnerabilities, the Contractor must implement appropriate mitigation measures promptly on notification of the zero-day vulnerability. The Contractor must remediate zero-day, high and critical vulnerabilities through patching, decommission, or compensating controls. The Contractor must patch high vulnerabilities within 30 days or less of discovery and patch medium vulnerabilities within 90 days or less of discovery. The Contractor must ensure that a vulnerability scan is completed on components of all Systems: with any identified vulnerabilities remedied, before being placed into production; and on a regular schedule, set at a minimum of one scan per quarter, unless the Province otherwise consents in writing. The Contractor must ensure that a vulnerability scan is completed on any web applications used for Tenancy or in any other Systems: and on any major changes to such web applications, with any identified vulnerabilities remedied, before being placed into production; and on a regular schedule, set at a minimum of one scan per quarter, unless the Province otherwise consents in writing. The Contractor must ensure that all Systems servers: have antivirus and malware protection configured, active and enabled at all times; have antivirus and malware definitions updated at least once a day; and are configured to undergo a full anti-virus scan for latent infections (to detect infections missed by the real-time agent) at least once a week. The Contractor must ensure that all disposals of assets used in providing or relating to the Services are done in a secure manner that ensures that Protected Information cannot be recovered. The Contractor must have asset management and disposal Policies that are followed, and reviewed and updated regularly in line with security best practices, and that address hardware, software and other critical business assets. The Contractor must keep an asset management inventory that includes ...