Question

A critical security vulnerability is being actively exploited against a public-facing web application. The security team has a tested patch ready and needs it deployed within the hour to stop data loss. The change authority for normal changes only convenes weekly, and the next assessment is four days away. Which approach to change enablement is most appropriate for this situation?

Accepted Answer

Treat it as an emergency change and route it to the emergency change authority for expedited assessment and authorization

Answer

Log it as a standard change since a tested patch already exists, so it is pre-authorized and needs no further review

Answer

Submit it as a normal change and wait for the next scheduled change-authority assessment

Answer

Deploy the patch immediately without any authorization and record it as an incident afterward