Question

A critical security vulnerability is being actively exploited against a public-facing e-commerce platform. The security team has a patch ready and needs it deployed within the hour to stop ongoing data loss. Under change enablement, how should this be handled and what trade-off is typically accepted?

Accepted Answer

As an emergency change, which follows an expedited assessment and authorization process and may accept reduced testing to resolve the urgent situation quickly

Answer

As a normal change, scheduled through the next change-authority assessment to ensure full risk assessment before deployment

Answer

As a standard change, since security patches are low-risk and pre-authorized, so no separate assessment is needed

Answer

As a service request, because a defined and repeatable procedure exists for applying patches