Security patches applied on a defined cycle
Dependencies are audited on a schedule, and security patches are applied and tested before they reach production, rather than waiting for an incident to force the issue.
- Regular audit of dependencies in use
- Security patches tested in staging first
- Out-of-cycle patches for urgent issues