Question

A critical zero-day vulnerability affecting an internet-facing application server has been publicly disclosed, and an active exploit is circulating. The vendor has released an emergency patch. During a review of the organization's response, an IS auditor notes that the operations team deployed the patch directly to production within hours, bypassing the normal test cycle, but did complete a documented emergency change request approved by the change advisory board on-call authority. What should the auditor conclude?

Accepted Answer

The deployment was appropriate because the emergency change process was followed and the exploited risk justified expedited action, but the auditor should verify post-implementation testing and rollback readiness were performed

Answer

The deployment violated change management because all patches must complete full regression testing before reaching production regardless of severity

Answer

The deployment was acceptable and requires no further review since board approval was obtained

Answer

The patch should not have been applied at all until the next scheduled maintenance window to avoid unplanned downtime