Skip to main content
U.S. flag

An official website of the United States government

Dot gov

The .gov means it’s official.
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.


The site is secure.
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.

Creating a Patch and Vulnerability Management Program



Peter M. Mell, Tiffany Bergeron, Dave Henning


[Superseded by SP 800-40 Rev. 3 (July 2013):] This document provides guidance on creating a security patch and vulnerability management program and testing the effectiveness of that program. The primary audience is security managers who are responsible for designing and implementing the program. However, this document also contains information useful to system administrators and operations personnel who are responsible for applying patches and deploying solutions (i.e., information related to testing patches and enterprise patching software). [Supersedes SP 800-40 (August 2002):]
Special Publication (NIST SP) - 800-40 Ver 2.0
Report Number
800-40 Ver 2.0


computer security, security patches, vulnerability management
Created November 16, 2005, Updated February 19, 2017