ISA/IEC 62443 treats patch management as a risk-based organizational process, not a reactive or purely technical activity. Within 62443-2-1 and related asset owner requirements, patching is explicitly linked to risk assessment, operational impact, safety, and availability.
Step 1: Risk-based decision making
Patches introduce both benefits (vulnerability mitigation) and risks (downtime, instability, safety impact). ISA
/IEC 62443 requires asset owners to evaluate patches based on their contribution to reducing cybersecurity risk while considering operational constraints.
Step 2: Integration into management processes
Patch management is part of configuration management, change management, and incident prevention. This ensures patches are tested, scheduled, approved, and deployed in a controlled manner consistent with business priorities.
Step 3: Avoiding incorrect approaches
* Ignoring downtime and cost violates availability and safety objectives.
* Waiting until after an attack contradicts preventive risk management.
* Treating patching as purely technical ignores business, safety, and production impacts.
Step 4: Lifecycle alignment
ISA/IEC 62443 emphasizes that patching must be planned and executed throughout the Operate and Maintain phase as part of continuous risk reduction.
Therefore, the standard clearly requires patching to be handled as part of the broader risk management strategy, making Option C correct.