Creating a Patch and Vulnerability Management Program

Published

November 16, 2005

Author(s)

Peter M. Mell, Tiffany Bergeron, Dave Henning

Abstract

[Superseded by SP 800-40 Rev. 3 (July 2013): http://www.nist.gov/manuscript-publication-search.cfm?pub_id=913929] This document provides guidance on creating a security patch and vulnerability management program and testing the effectiveness of that program. The primary audience is security managers who are responsible for designing and implementing the program. However, this document also contains information useful to system administrators and operations personnel who are responsible for applying patches and deploying solutions (i.e., information related to testing patches and enterprise patching software). [Supersedes SP 800-40 (August 2002): http://www.nist.gov/manuscript-publication-search.cfm?pub_id=151264]

Citation

Special Publication (NIST SP) - 800-40 Ver 2.0

Report Number

800-40 Ver 2.0

NIST Pub Series

Special Publication (NIST SP)

Pub Type

NIST Pubs

Supercedes Publication

Procedures for Handling Security Patches

Superceded By Publication

Guide to Enterprise Patch Management Technologies

Keywords

computer security, security patches, vulnerability management

Citation

Mell, P. , Bergeron, T. and Henning, D. (2005), Creating a Patch and Vulnerability Management Program, Special Publication (NIST SP), National Institute of Standards and Technology, Gaithersburg, MD (Accessed October 10, 2025)