Patch Management
Structured update procedure
TL;DR
Patch management under § 30(2) no. 5 of the German BSI Act (BSIG) is the structured identification, assessment, testing and deployment of software updates. Standards: NIST SP 800-40, ISO 27002 (8.8).
What is patch management?
Patch management cycle:
- Identify the vulnerability (CVE feed, vendor advisory)
- Assess criticality (CVSS score)
- Test the patch (staging environment)
- Deploy plus rollout plan
- Verify and document
Best-practice cycles:
- Critical patches: 24-72h
- High: 1 week
- Medium: 1 month
- Low: 3 months
Practical example
Microsoft Patch Tuesday: 12 patches. CVSS >9: 2 of them → immediately. CVSS 7-8.9: 4 of them → 1 week. The remainder: 1 month.
Note: the cycle and CVSS figures are best-practice recommendations (NIST SP 800-40, ISO/IEC 27002 no. 8.8) and not statutory deadlines.
Legal basis in Germany and Austria
Patch and vulnerability management is part of the risk-management measures under NIS2. It falls under the measure "security in acquisition, development and maintenance, including vulnerability handling and disclosure" (Art. 21(2)(e) of the NIS2 Directive (Directive (EU) 2022/2555)). The national implementation differs in its citation and supervisory authority:
Germany
The relevant provision is § 30(2) no. 5 BSIG: "security measures in the acquisition, development and maintenance of information technology systems, components and processes, including vulnerability handling and disclosure". Patch and vulnerability management falls under this — not under no. 7, which covers only "basic training and awareness-raising measures". The competent supervisory authority is the Federal Office for Information Security (BSI).
Austria
The substantively corresponding counterpart is § 32(4)(e) of the Austrian Network and Information Systems Security Act 2026 (NISG 2026) (BGBl. I Nr. 94/2025): "security measures in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure". The competent supervisory authority is the Cybersecurity Authority (Cybersicherheitsbehörde, Austria) (a subordinate authority of the Federal Minister of the Interior).