Patch management process is documented for critical updates

PCI-DSS 4.0 Req 6.3 requires that security vulnerabilities in all system components are identified and ranked by risk; Req 6.3.3 requires that all system components are protected from known vulnerabilities by installing applicable security patches. Without a documented patch policy with SLA timeframes, a critical CVE in a production dependency may sit unaddressed for weeks while your CDE remains exposed. CWE-1357 (Reliance on Uncontrolled Component) is the mechanism by which supply-chain vulnerabilities become active exploits. NIST SI-2 and SSDF RV.1 both require a defined remediation timeline tied to severity.

Create docs/patch-management.md defining at minimum two severity tiers with explicit SLA deadlines (e.g., critical: 48 hours, high: 7 days) and configure automated patching via Dependabot or Renovate. The document and the automation together satisfy PCI-DSS 4.0 Req 6.3.3.

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: daily
      time: "02:00"
    open-pull-requests-limit: 5
    reviewers:
      - security-team

In the policy document, state explicitly: "Critical patches (CVSS 9.0+): applied within 48 hours. High patches (CVSS 7.0–8.9): applied within 7 days." Link the Dependabot config from the policy document so the audit trail from documented SLA to automated enforcement is traceable.