Vulnerability & Patch Management Policy
Company: Payzario Inc. | Effective Date: April 2025 | Version: 1.0
1. Purpose
This policy defines Payzario's approach to identifying, evaluating, and remediating security vulnerabilities across its systems, dependencies, and third-party integrations including Plaid and Stripe.
2. Scope
This policy applies to all Payzario production systems, application code, infrastructure, third-party libraries, APIs, and cloud services used to operate the Payzario platform.
3. Vulnerability Identification
- Dependency scanning is performed on all npm packages upon each deployment.
- Security advisories from Plaid, Stripe, and other vendors are monitored continuously.
- Code reviews are required for all changes to authentication, payment, or data access logic.
- Third-party penetration testing is conducted at least annually.
4. Severity Classification
| Severity | Description | Remediation SLA |
|---|---|---|
| Critical | Exploitable, data breach risk, system compromise | 7 days |
| High | Significant risk, active exploitation possible | 14 days |
| Medium | Moderate risk, limited exploitation | 30 days |
| Low | Minimal risk, informational | Normal update cycle |
5. Patch Management
- All critical and high-severity patches are applied within their SLA windows.
- Patches are tested in a staging environment before production deployment.
- Emergency patches may bypass staging with documented approval from an admin.
- Patch status is tracked and logged for audit purposes.
6. Third-Party Vendor Security
Payzario monitors security bulletins from all third-party vendors (including Plaid and Stripe). API SDK versions are kept up to date. Any notification of a vendor breach triggers immediate internal review.
7. Active Vulnerability Scanning
Actively performing vulnerability scans on employee and contractor machines, as well as production assets, is essential for detecting and addressing security vulnerabilities before they can be exploited.
Scope of Scanning
- All employee and contractor laptops and workstations used to access Payzario systems.
- Production servers, cloud infrastructure, and hosted application environments.
- All application dependencies (npm packages, SDKs, third-party libraries).
- Network-accessible endpoints and APIs exposed to the internet.
Automated Scanning Requirements
- Automated vulnerability scans are run on every deployment to detect newly introduced weaknesses.
- Dependency scans (e.g., npm audit) run automatically in the CI/CD pipeline.
- Scheduled full-environment scans are conducted at minimum monthly.
- Scan results are reviewed and triaged within 5 business days of completion.
Endpoint Security (Laptops & Devices)
- All employee and contractor devices used for Payzario work must have up-to-date OS and software patches applied.
- Anti-malware or endpoint protection software is required on all devices with access to production systems or customer data.
- Devices with outdated software or missing patches must remediate before accessing production environments.
Prompt Remediation
- Identified vulnerabilities are remediated according to the severity SLAs defined in Section 4.
- Critical findings from automated scans are escalated immediately and treated as incidents.
- All scan findings and remediation actions are documented for audit and compliance purposes.
- Unresolved findings beyond their SLA window are escalated to admin and documented with a risk-acceptance justification.
8. Patching SLA & Timely Remediation
Promptly patching identified vulnerabilities is essential to mitigate the risk of security breaches and keep Payzario's systems secure against emerging threats. A defined SLA for patching ensures vulnerabilities are addressed in a timely manner, reducing the window of exposure.
Defined Patching SLAs
- Critical: Patch or mitigate within 7 days of identification.
- High: Patch or mitigate within 14 days of identification.
- Medium: Patch or mitigate within 30 days of identification.
- Low: Addressed within the normal update cycle; no hard deadline but tracked for completion.
SLA Adherence & Tracking
- All identified vulnerabilities are logged immediately upon discovery with severity, discovery date, and assigned SLA deadline.
- Patch status is tracked continuously and reviewed at least weekly to ensure SLA compliance.
- Any vulnerability approaching its SLA deadline without resolution is escalated to the admin for prioritization.
- Vulnerabilities that cannot be patched within SLA windows must be documented with a formal risk-acceptance justification signed by an admin.
Reducing the Window of Exposure
- Emergency patches for critical vulnerabilities may bypass staging with documented admin approval to minimize exposure time.
- Compensating controls (e.g., network restrictions, feature flags, WAF rules) are applied immediately when a patch cannot be deployed right away.
- All compensating controls are logged and remain in place only until the full patch is applied.
Reporting & Audit Trail
- All patching activity — including discovery date, severity, SLA deadline, patch date, and reviewer — is recorded for audit purposes.
- Monthly patch compliance summaries are reviewed by the admin to confirm SLA adherence trends.
- Records are retained for a minimum of 3 years to support compliance reviews.
9. Policy Review
This policy is reviewed annually or following any significant vulnerability event or infrastructure change.
Owner: Payzario Inc. | Contact: support@payzario.com