How do I answer the cyber insurance question about installing security patches?

What exactly does the form ask?

These are the forms' own words, with the form and page each comes from.

Do you, or an outsourced service provider on your behalf, actively manage and install critical patches across your internet-facing systems?

If Yes, are critical patches installed within 30 days of release?

Does the Applicant have processes in place to implement, within 14 days, all critical security, anti-virus and malware patches received from commercial software vendors deployed to all of its servers, laptops, desktops, routers, firewalls and phones?

Please describe your patch management process and how you ensure that all critical patches are applied in a timely fashion

What does it mean for a small firm?

Internet-facing systems are the ones anyone can reach: the website, the VPN, the firewall, the mail server if you run one. One form lists routers, firewalls and phones as well as computers.

How do I answer it truthfully?

Read the update history of each system, including the firewall and router, which are often forgotten. Answer with the slowest of them, not the fastest.

What can an outside reading show, and what can it not?

Where a service on the internet states its software version, an outside reading can match that version against published flaws.

It cannot see the update history of laptops, desktops or anything inside your network.

Which questions sit next to this one?

• End of life software
• Firewalls
• Antivirus and endpoint protection