# OT vulnerability, patch and change management

Assess CVE scores alongside process impact. Connect vendor validation, representative testing, maintenance windows and rollback evidence.

Original AI-assisted SecNet educational content. Fictional local examples; not a standards provider publication, endorsement or compliance evidence. Page exercises do not create account progress.

Sources checked: 2026-10-21

## Link advisories to assets

A CVE advisory does not automatically establish that a Harbor device is affected. Compare the exact product, revision, configuration, prerequisites and exposure path. A high technical score does not by itself describe physical consequences, while a lower score can still matter to a critical function. Unknown inventory revisions create an open validation need, not a closed finding. Combine vendor advisories with site-owner knowledge. This exercise performs no device queries, exploitation, vulnerability scans or control-network traffic; it teaches how to build an evidence-based review record.

## Representative validation before patching

The availability of an update package is insufficient justification for installation. Review vendor support, tooling/firmware compatibility, integration dependencies and representative test scope. Document how the test environment differs from the plant; a successful boot does not validate production functions. Harbor looks for maintenance-window approval and the existing site change process. This lesson prescribes no generic installation sequence or out-of-window intervention. Actual changes require authorization under local operating and safety needs; a correct model result cannot supply that authority.

## Own the risk of deferral

When patching is deferred, record rationale, threat/exposure context, compensation, owner and expiry. A claimed tighter network boundary needs configuration and appropriate validation evidence. An indefinite exception without a business rationale does not resolve the issue. The risk owner defines reassessment triggers, such as a changed threat or maintenance opportunity. Harbor evaluates records only and modifies no firewall rules. Keep the assertion that compensation exists separate from evidence that it works. Deferral should leave an accountable plan rather than a permanently accepted technical label.

## Rollback and closure

A rollback plan is more than the location of an older file. Identify tools, licenses, approved revisions, dependencies and authorized decision conditions, then test in an appropriate representative environment. After a change, record who accepted each functional and integrity evidence item. Keep monitoring and process-observation scope explicit; no observed error alone does not close the change. Harbor workpapers compare before/after revisions and unresolved questions. They are not field procedures for restoration or restart and cannot determine a safe operating sequence for a specific plant.

## Working sequence

1. Map the advisory to product and revision.
2. Record exposure and process consequence.
3. Request vendor, test and window evidence.
4. Review compensation and rollback gaps.
5. Record the decision, owner, expiry and triggers.

## 1. CVE and actual scope

An advisory establishes neither the affected revision nor exposure. Decisions based only on its score are incomplete without comparison and process-impact review.

This code is a local policy model; it does not replace actual equipment, process or safety assessment.

### Weak implementation
```js
s => s.cveKnown === true
```

### Corrected implementation
```js
s => s.cveKnown === true &&
  s.affectedVersionChecked === true &&
  s.exposureReviewed === true &&
  s.processImpact === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "cveKnown": true,
        "affectedVersionChecked": true,
        "exposureReviewed": true,
        "processImpact": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-affectedVersionChecked",
      "input": {
        "cveKnown": true,
        "affectedVersionChecked": false,
        "exposureReviewed": true,
        "processImpact": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-processImpact",
      "input": {
        "cveKnown": true,
        "affectedVersionChecked": true,
        "exposureReviewed": true,
        "processImpact": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "cveKnown": true,
        "affectedVersionChecked": true,
        "exposureReviewed": true,
        "processImpact": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-affectedVersionChecked",
      "input": {
        "cveKnown": true,
        "affectedVersionChecked": false,
        "exposureReviewed": true,
        "processImpact": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-processImpact",
      "input": {
        "cveKnown": true,
        "affectedVersionChecked": true,
        "exposureReviewed": true,
        "processImpact": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 2. Package available: install?

Publication does not replace compatibility testing and window approval. The model requires vendor validation and representative testing; real deployment needs separate site authority.

This code is a local policy model; it does not replace actual equipment, process or safety assessment.

### Weak implementation
```js
s => s.updateAvailable === true
```

### Corrected implementation
```js
s => s.updateAvailable === true &&
  s.vendorValidated === true &&
  s.representativeTest === true &&
  s.windowApproved === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "updateAvailable": true,
        "vendorValidated": true,
        "representativeTest": true,
        "windowApproved": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-vendorValidated",
      "input": {
        "updateAvailable": true,
        "vendorValidated": false,
        "representativeTest": true,
        "windowApproved": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-windowApproved",
      "input": {
        "updateAvailable": true,
        "vendorValidated": true,
        "representativeTest": true,
        "windowApproved": false
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "updateAvailable": true,
        "vendorValidated": true,
        "representativeTest": true,
        "windowApproved": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-vendorValidated",
      "input": {
        "updateAvailable": true,
        "vendorValidated": false,
        "representativeTest": true,
        "windowApproved": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-windowApproved",
      "input": {
        "updateAvailable": true,
        "vendorValidated": true,
        "representativeTest": true,
        "windowApproved": false
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## 3. Owner of the deferred patch

Review deferral with evidenced compensation, an expiry owner and tested rollback. These conditions establish traceability of a decision, not elimination of risk.

This code is a local policy model; it does not replace actual equipment, process or safety assessment.

### Weak implementation
```js
s => s.deferred === true
```

### Corrected implementation
```js
s => s.deferred === true &&
  s.compensationVerified === true &&
  s.expiryOwned === true &&
  s.rollbackTested === true
```

### Synthetic input and actual model output
```json
{
  "before": [
    {
      "name": "documented-case",
      "input": {
        "deferred": true,
        "compensationVerified": true,
        "expiryOwned": true,
        "rollbackTested": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-compensationVerified",
      "input": {
        "deferred": true,
        "compensationVerified": false,
        "expiryOwned": true,
        "rollbackTested": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    },
    {
      "name": "missing-expiryOwned",
      "input": {
        "deferred": true,
        "compensationVerified": true,
        "expiryOwned": false,
        "rollbackTested": true
      },
      "expected": false,
      "observed": true,
      "matched": false
    }
  ],
  "after": [
    {
      "name": "documented-case",
      "input": {
        "deferred": true,
        "compensationVerified": true,
        "expiryOwned": true,
        "rollbackTested": true
      },
      "expected": true,
      "observed": true,
      "matched": true
    },
    {
      "name": "missing-compensationVerified",
      "input": {
        "deferred": true,
        "compensationVerified": false,
        "expiryOwned": true,
        "rollbackTested": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    },
    {
      "name": "missing-expiryOwned",
      "input": {
        "deferred": true,
        "compensationVerified": true,
        "expiryOwned": false,
        "rollbackTested": true
      },
      "expected": false,
      "observed": false,
      "matched": true
    }
  ]
}
```

## Exit evidence

- CVE/asset/prerequisite/impact assessment.
- Versioned change, test and time-bound exception record.

## References

- [NIST SP 800-82 Rev.3 · Final September 2023](https://csrc.nist.gov/pubs/sp/800/82/r3/final)
- [NIST SP 1800-10 · Manufacturing system integrity · Final March 2022](https://csrc.nist.gov/pubs/sp/1800/10/final)