Question

A critical vulnerability is being actively exploited, and the security team must deploy an emergency patch to production servers outside the normal maintenance window. According to sound change management practice, what should the team do to remain compliant while acting quickly?

Accepted Answer

Apply the patch immediately and document the emergency change, then submit it for retroactive review and approval per the emergency change process

Answer

Skip all change management steps because emergencies are exempt from any documentation requirements

Answer

Wait for the next scheduled change advisory board meeting before applying the patch to preserve the normal approval flow

Answer

Apply the patch silently and delete any logs so the unscheduled change does not appear in the audit trail