The purpose of this Patch Management Policy and Procedure is to define the guidelines and responsibilities for managing software patches across all systems and devices within Elcen Metal Products Co . This policy aims to ensure the security, reliability, and integrity of our information technology infrastructure by promptly identifying, evaluating, and applying patches to mitigate vulnerabilities and minimize potential risks. 1.1.Security Enhancement: By promptly applying patches, the organization can mitigate known vulnerabilities in software applications and operating systems, reducing the risk of unauthorized access, data breaches, and cyberattacks. 1.2.Risk Mitigation: Through regular monitoring and assessment of patch releases, the organization can identify and prioritize patches based on their criticality and potential impact on the IT infrastructure. This proactive approach helps mitigate risks associated with unpatched systems and ensures the integrity and availability of business-critical resources. 1.3.Compliance Adherence: Compliance with industry regulations and standards, such as GDPR, HIPAA, or PCI DSS, often requires organizations to implement effective patch management practices. This policy helps Elcen Metal Products Co . demonstrate compliance with relevant legal and regulatory requirements by maintaining up-to-date systems and protecting sensitive information from security threats. 1.4.Operational Continuity: By scheduling patch deployments during designated maintenance windows and conducting thorough testing before implementation, the organization minimizes disruption to business operations and ensures the continued availability and reliability of IT services. 1.5. Documentation and Accountability: The policy establishes clear roles and responsibilities for IT personnel, system administrators, and end-users in the patch management process. Documentation of patch activities and periodic audits ensure accountability and provide a comprehensive record of compliance efforts.

2. Scope:

This policy applies to all employees, contractors, and third-party vendors who have access to Elcen Metal Products Co IT resources, including but not limited to desktops, laptops, servers, network devices, and software applications. 2.1.Systems and Devices: The policy applies to all hardware devices and systems within ABC Contracting Inc.'s IT environment, including desktops, laptops, servers, network devices (routers, switches, firewalls), and mobile devices (smartphones, tablets). 2.2.Software Applications: All software applications and programs utilized by the organization are included within the scope of the policy. This includes operating systems, productivity suites, enterprise software, custom applications, and third-party software solutions. c.Employees and Contractors: The policy applies to all employees, contractors, consultants, and third-party vendors who have access to Elcen Metal Products Co resources. All personnel are expected to adhere to the patch management procedures outlined in the policy. d.IT Infrastructure: The policy covers both on-premises and cloud-based IT infrastructure components. Regardless of the deployment model, all systems and services utilized by the organization fall under the purview of the patch management policy. e.Security Vulnerabilities: The policy addresses the identification and mitigation of security vulnerabilities through timely patching. It encompasses patches released by software vendors to address known vulnerabilities, security advisories, and alerts related to potential threats. f.Compliance Requirements: Compliance with industry regulations, legal standards, and contractual obligations related to patch management is within the scope of the policy. g.Documentation and Reporting: The policy governs the documentation of patch management activities, including patch inventories, deployment schedules, verification results, and compliance reports. Accurate and up-to-date documentation is essential for accountability, auditing, and compliance purposes. Our Leader development programes provide comprehesive solutions focused on creating organizational capacity through planned development of your most promissing leader talent including Leadership Pipeline Development, Leader Coaching, Succession Management and Performance Management

3. Patch Management Responsibilities

3.1. IT Department: a.Inventory Management: Develop and maintain an inventory of all systems and software applications within the organization. b.Vulnerability Monitoring: Monitor vendor security alerts, advisories, and industry sources for the release of new patches and updates. c.Risk Assessment: Assess the criticality and potential impact of patches based on risk analysis and vulnerability severity. d.Testing: Conduct testing of patches in a controlled environment to evaluate compatibility and mitigate risks associated with deployment. e.Deployment Planning: Schedule and coordinate patch deployments during designated maintenance windows to minimize disruption to business operations. f.Documentation: Maintain comprehensive documentation of patch management activities, including patch inventories, deployment schedules, testing results, and any issues encountered during the process. g.Auditing and Compliance: Conduct periodic audits to ensure compliance with patch management procedures and regulatory requirements 3.2. System Administrators: a. Patch Installation: Install approved patches and updates on all relevant systems within the specified timeframe. b. Monitoring and Troubleshooting: Monitor patch deployment status and address any failures or issues promptly to ensure successful installation. c. Communication: Coordinate with end-users to schedule system reboots or downtime as necessary to complete patch installations. d .Documentation: Maintain records of patch deployment activities, including installation dates, systems updated, and any issues encountered during the process. 3.3. End-Users: a. Reporting: Promptly report any system or application vulnerabilities to the IT department for assessment and remediation. b. Cooperation: Follow instructions provided by the IT department for rebooting or updating systems to ensure timely patch installations. c. Security Awareness: Adhere to security best practices to minimize the risk of exploitation, including avoiding unauthorized software installations and practicing safe browsing habits.