Advice, guidance and other resources for managing vulnerabilities.
Pages
Page 7 of 12
5. The organisation must own the risks of not updating
There may sometimes be legitimate reasons not to update. The decision not to is a senior-level risk decision, and should be considered in the wider context of organisational risk management policy and practice.
Thinking behind this principle
You will probably find more issues than you have resources available to fix them. The decision not to fix an issue is, at root, a senior-level business risk decision, not an IT problem, and every organisation has its own risk appetite. There are many legitimate factors to consider here including cost, resources, complexity and other operational risks. The aim should still be to update by default and to minimise the need to make decisions on a case-by-case basis. The organisation’s risk management structures and staff need to be aware of the risk the organisation has chosen to tolerate at the present time.
Potential impact on the system or service – for example, do you have effective backups, and sufficient knowledge of the system to recover it?
Potential for reputational damage to the system, service or your organisation.
Direct cost, such as replacing obsolete systems.
Availability and cost of a short-term fix.
Availability and cost of skilled resources to carry out the work.
Cost of incident response and recovery, including any fines imposed in a worst-case scenario.
Once a decision is made, record the reasons behind it, and ensure any remaining risk is considered in your organisation's overall risk management framework. This may be a risk register where you can group all the same risks such as ‘High: Unpatched externally exposed vulnerabilities allows initial compromise’. It's important that the business owns the risk, not the security team, and that it is visible to senior leaders.
