Scenario:

ABC is a major widget distributor. They make the best widgets in the United States as a result of a secret manufacturing process that they created. ABC is located in California and New Jersey, for ease of widget shipping nationwide. They are a small organization with less than 200 employees.

At their California site, which is their corporate headquarters, they have a two-story building with security guards who patrol on the hour. Employees enter and exit through the main door where the administrative assistant sits.

At their New Jersey site, they rent office space and have a storage facility off-site. They do not have security guards at this site, but they do have a proximity badge access system.

Because ABC sells their widgets online, PCI DSS is an important regulation for them. Since ABC is a small organization, they often have to "make do" with what is available. They do not always have the most current hardware and software, but the database runs just fine. They have one database administrator (DBA) and back up their ordering system to the cloud. They have two system administrators to work on the local servers. Because their manufacturing process is proprietary, that is kept locally in the California office on the servers there.

Their infrastructure consists of two database instances, cloud backups of orders, corporate laptops, a shared printer at each site, and a firewall. Employees are authorized to work at home or when traveling.

What should the evaluation of the Patch management program by including the following below look like?

•  avenues of notifications
• frequency of updates
• tools used
• the methodology used for the system described in the scenario.