{"format":"epicdraw-workspace","version":1,"charts":[{"id":"template-patch-management-process","name":"Vulnerability and patch management process","paper":"white","pattern":"blank","wobble":0.22,"ppm":48,"nodes":[{"id":"patch-management-process-n1","type":"lane","text":"","x":0,"y":0,"w":1720,"h":1000,"fill":"none","fst":"solid","seed":701,"font":"sans","fs":22,"bold":false,"lv":0,"lock":true,"z":-20,"ink":"navy"},{"id":"patch-management-process-n2","type":"text","text":"Vulnerability and patch management process","x":42,"y":24,"w":1620,"h":64,"fill":"none","fst":"solid","seed":702,"font":"hand","fs":48,"bold":true,"lv":0,"align":"left","ink":"navy"},{"id":"patch-management-process-n3","type":"text","text":"Run the patch cycle from asset discovery and scanning through prioritisation, testing and phased rollout to verification.","x":42,"y":96,"w":1620,"h":44,"fill":"none","fst":"solid","seed":703,"font":"sans","fs":23,"bold":false,"lv":0,"align":"left","ink":"grey"},{"id":"patch-management-process-n4","type":"line","text":"","x":42,"y":160,"w":1636,"h":4,"fill":"none","fst":"solid","seed":704,"font":"sans","fs":22,"bold":false,"lv":0,"rot":0,"head":"none","ink":"navy"},{"id":"patch-management-process-n5","type":"text","text":"EXAMPLE TEMPLATE · Replace the example content, owners and dates with your own.","x":42,"y":952,"w":1630,"h":30,"fill":"none","fst":"solid","seed":705,"font":"sans","fs":18,"bold":false,"lv":0,"align":"left","ink":"grey"},{"id":"patch-management-process-n6","type":"round","text":"Discover\nall assets","x":45,"y":260,"w":240,"h":90,"fill":"sky","fst":"solid","seed":706,"font":"sans","fs":17,"bold":true,"lv":0},{"id":"patch-management-process-n7","type":"round","text":"Scan for\nvulnerabilities","x":335,"y":260,"w":240,"h":90,"fill":"sky","fst":"solid","seed":707,"font":"sans","fs":17,"bold":true,"lv":0},{"id":"patch-management-process-n8","type":"round","text":"Prioritise: severity,\nexploited, exposed","x":625,"y":260,"w":240,"h":90,"fill":"sun","fst":"solid","seed":708,"font":"sans","fs":17,"bold":true,"lv":0},{"id":"patch-management-process-n9","type":"round","text":"Test in\nstaging","x":915,"y":260,"w":240,"h":90,"fill":"mint","fst":"solid","seed":709,"font":"sans","fs":17,"bold":true,"lv":0},{"id":"patch-management-process-n10","type":"round","text":"Change\napproval","x":915,"y":520,"w":240,"h":90,"fill":"mint","fst":"solid","seed":710,"font":"sans","fs":17,"bold":true,"lv":0},{"id":"patch-management-process-n11","type":"round","text":"Ring 1: pilot\ndevices","x":625,"y":520,"w":240,"h":90,"fill":"peach","fst":"solid","seed":711,"font":"sans","fs":17,"bold":true,"lv":0},{"id":"patch-management-process-n12","type":"round","text":"Ring 2: all\ndevices","x":335,"y":520,"w":240,"h":90,"fill":"peach","fst":"solid","seed":712,"font":"sans","fs":17,"bold":true,"lv":0},{"id":"patch-management-process-n13","type":"round","text":"Verify\nand rescan","x":45,"y":520,"w":240,"h":90,"fill":"leaf","fst":"solid","seed":713,"font":"sans","fs":17,"bold":true,"lv":0},{"id":"patch-management-process-n22","type":"table","text":"","x":1250,"y":205,"w":425,"h":280,"fill":"sky","fst":"solid","seed":722,"font":"sans","fs":17,"bold":false,"lv":0,"rows":[["Severity","Patch within"],["Critical, exploited","48 hours"],["Critical","7 days"],["High","30 days"],["Medium","60 days"],["Low","90 days"]]},{"id":"patch-management-process-n23","type":"lane","text":"","x":1250,"y":520,"w":425,"h":171,"fill":"none","fst":"solid","seed":723,"font":"sans","fs":22,"bold":false,"lv":0,"z":-1},{"id":"patch-management-process-n24","type":"rect","text":"Exceptions register","x":1250,"y":520,"w":425,"h":56,"fill":"rose","fst":"solid","seed":724,"font":"sans","fs":24,"bold":true,"lv":0},{"id":"patch-management-process-n25","type":"text","text":"If a patch cannot be applied, record\nthe risk, a compensating control,\nan owner and a review date.","x":1268,"y":590,"w":389,"h":89,"fill":"none","fst":"solid","seed":725,"font":"sans","fs":21,"bold":false,"lv":0,"align":"left"},{"id":"patch-management-process-n26","type":"text","text":"Example targets. Set your own from your risk appetite and any compliance requirements.","x":45,"y":700,"w":1150,"h":30,"fill":"none","fst":"solid","seed":726,"font":"sans","fs":17,"bold":false,"lv":0,"align":"left","ink":"grey"}],"edges":[{"id":"patch-management-process-e14","from":"patch-management-process-n6","to":"patch-management-process-n7","label":"","seed":714,"style":"straight","head":"end","lv":0,"font":"sans","fs":18},{"id":"patch-management-process-e15","from":"patch-management-process-n7","to":"patch-management-process-n8","label":"","seed":715,"style":"straight","head":"end","lv":0,"font":"sans","fs":18},{"id":"patch-management-process-e16","from":"patch-management-process-n8","to":"patch-management-process-n9","label":"","seed":716,"style":"straight","head":"end","lv":0,"font":"sans","fs":18},{"id":"patch-management-process-e17","from":"patch-management-process-n9","to":"patch-management-process-n10","label":"","seed":717,"style":"elbow","head":"end","lv":0,"font":"sans","fs":18,"sa":"b","ea":"t"},{"id":"patch-management-process-e18","from":"patch-management-process-n10","to":"patch-management-process-n11","label":"","seed":718,"style":"straight","head":"end","lv":0,"font":"sans","fs":18},{"id":"patch-management-process-e19","from":"patch-management-process-n11","to":"patch-management-process-n12","label":"","seed":719,"style":"straight","head":"end","lv":0,"font":"sans","fs":18},{"id":"patch-management-process-e20","from":"patch-management-process-n12","to":"patch-management-process-n13","label":"","seed":720,"style":"straight","head":"end","lv":0,"font":"sans","fs":18},{"id":"patch-management-process-e21","from":"patch-management-process-n13","to":"patch-management-process-n7","label":"Next cycle","seed":721,"style":"elbow","head":"end","lv":0,"font":"sans","fs":18,"sa":"t","ea":"b","dash":true}],"strokes":[],"imgs":{}}],"cur":"template-patch-management-process"}