An IS auditor is reviewing an organization's patch management process and finds that critical patches take an average of 45 days to deploy. The BEST recommendation is:
-
A
Accept the risk because vendors often release flawed patches
-
B
Implement a risk-based patching policy with shorter windows for critical vulnerabilities
-
C
Require all patches to be tested for 60 days before deployment
-
D
Outsource patch management to a managed service provider