Policy status: Approved and actively followed. We maintain vulnerability-management, patch prioritisation and controlled production remediation practices. Effective April 11, 2026.
Purpose and scope
We keep systems supported, prioritise security weaknesses, and patch with controlled non-disruptive release procedures.
This policy applies to personnel, contractors, technology and third parties acting for Pingplus Media to the extent of their approved access and applicable agreements. Customer and supplier responsibilities are aligned with our executed contracts and applicable law.
Controls and practices in operation
- We maintain an OS/runtime/dependency inventory showing host, package, owner, version, support status, production criticality and known vulnerabilities.
- We perform authorised vulnerability checks for internet-facing assets at least quarterly and for critical exposed components more frequently where safe mechanisms exist. Active scans are scoped and approved before execution.
- We prioritise confirmed exploitable critical issues for mitigation within 7 calendar days, high within 30, medium within 90, or document approved compensating controls where service stability requires longer.
- We apply hardening baselines to new builds and periodically confirm secure remote access, least privilege, fail2ban/throttling where appropriate, secrets permissions, service exposure and patch baseline.
- We use staging, backups, partner-compatibility testing, connectivity baselines and documented rollback before production updates. Audit discovery is kept separate from service-impacting operations.
- We log vulnerability acceptance and closure with evidence, severity, owner and verifiable fixes; share redacted status with customers only when contractually required.
Review and responsibility
Monthly backlog review; quarterly baseline review; immediate triage for critical exploited weaknesses.
Accountability and reporting
Our personnel, contractors and in-scope service partners follow this policy, with established channels for prompt reporting of suspected security issues. Exceptions are recorded, reviewed and approved by an authorised policy owner. Applicable customer contracts and legal duties continue to govern the services provided.