Risk Assurance Review of Atos' Patch Management and Remediation Processes

NS&I has an outsourced customer servicing model which provides IT and infrastructure services. These services are provided to NS&I by Atos and includes patch management and vulnerability management. For NS&I systems to be protected from risks associated with patching, it is important that effective processes are in place to test patches, deploy patches into the operating environment and verify that each patch is deployed successfully. NS&I and Atos have agreed a business process outsourcing agreement which provides sufficient consideration to the key requirements of an effective patching process. The objective of this review is to provide assurance to NS&I management that Atos has fully completed the remedial patching required across the NS&I IT estate.