Question

A critical vulnerability with an active exploit in the wild is discovered on a customer-facing payment application. The security team has a validated vendor patch ready to deploy. Organizational policy requires all production changes to pass through the weekly Change Advisory Board (CAB) meeting, which is five days away. What is the MOST appropriate action for the vulnerability manager to take?

Accepted Answer

Invoke the emergency change process to obtain expedited approval, then deploy and document the change retroactively at the next CAB

Answer

Deploy the patch immediately without any change-management involvement to eliminate the exposure as fast as possible

Answer

Wait for the scheduled CAB meeting to preserve the integrity of the change-management workflow

Answer

Formally accept the risk with executive sign-off and defer patching until the regular maintenance window