Patch Management Policy

Gridcheck, LLC
Document Owner: Gridcheck Executive Leadership
Effective: August 2026
Review Frequency: Annual
Last Reviewed: August 2026
Next Scheduled Review: August 2027

1. Purpose

This Patch Management Policy defines Gridcheck’s process for identifying, evaluating, testing, and deploying security patches and updates to infrastructure and application components to reduce vulnerability risk and maintain system stability.

2. Scope

This policy applies to:

  • Production and staging infrastructure hosted in AWS
  • Operating systems and server environments under Gridcheck control
  • Application frameworks and third-party software libraries
  • Supporting infrastructure components within Gridcheck’s SaaS environment

AWS-managed services follow the AWS Shared Responsibility Model.

3. Roles and Responsibilities

Patch management oversight is the responsibility of Gridcheck executive leadership in coordination with authorized technical personnel.

Changes are tracked and managed through Gridcheck’s issue tracking system (Redmine).

4. Patch Identification and Evaluation

Gridcheck monitors:

  • Vendor security advisories
  • AWS service notifications
  • Framework and dependency updates
  • Security vulnerability disclosures

Patches are evaluated based on:

  • Severity (e.g., critical, high, moderate, low)
  • Exploitability
  • Potential impact to confidentiality, integrity, or availability

Critical security patches are evaluated promptly upon release and prioritized for expedited testing and deployment based on severity, exploitability, and operational impact.

5. Testing, Deployment, and Emergency Changes

Where applicable:

  1. Patches and updates are first deployed to a staging environment.
  2. Functional and regression testing is performed.
  3. Changes are reviewed and authorized internally prior to production deployment.
  4. Production deployment is performed in a controlled manner to minimize service disruption.
  5. Post-deployment validation is performed to confirm system stability.

Emergency patches may be deployed directly to production when necessary to mitigate an active security risk or restore service availability. When prior authorization is not practical due to the urgency of the situation, appropriate after-the-fact review, authorization, and management approval are completed and recorded in Redmine.

When immediate deployment of a critical patch is not feasible, Gridcheck implements appropriate temporary risk mitigation measures based on the nature of the vulnerability. Such measures may include restricting access, modifying system configurations, increasing monitoring, or applying vendor-recommended workarounds until the patch can be tested, approved, and deployed.

All emergency changes are formally documented in Redmine following deployment. Documentation includes the reason for the emergency change, actions taken, validation results, and any required follow-up activities.

6. Deployment Timing

Security patches and updates are scheduled to minimize customer impact. Where feasible, deployments occur during lower-usage periods.

7. Documentation and Tracking

All significant patch-related changes are documented and tracked within Redmine, including:

  • Description of update
  • Date of deployment
  • Environment affected
  • Authorization
  • Validation outcome
  • Reference to the associated Redmine issue

8. Review

This Patch Management Policy is reviewed annually and following significant infrastructure changes or security incidents.