# Ensure System Updates, Patches, and Security Software Are Installed

- Source: https://support.icompaas.com/support/solutions/articles/62000234999-ensure-system-updates-patches-and-security-software-are-installed
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon Linux 2 Benchmark v3.0.0](https://support.icompaas.com/support/solutions/62000112696) › [CIS Amazon Linux 2 Benchmarks](https://support.icompaas.com/support/solutions/folders/62000169265)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:** • Level 1

**Description:**  
 Keeping the operating system and installed software up-to-date with the latest patches, updates, and security software is essential for maintaining system security. This helps mitigate vulnerabilities, fix bugs, and protect against emerging threats.

Rationale: Regular installation of updates and security patches reduces the risk of exploitation by attackers and improves overall system stability and security posture.

**Impact:** Pros:

-   Protects systems from known vulnerabilities.  
    
-   Enhances system reliability and performance.  
    
-   Ensures compliance with security policies and standards.  
    

Cons:

-   Updates may occasionally introduce compatibility issues.  
    
-   Requires maintenance windows and administrative oversight.  
    

**Default Value:** Systems may or may not have automated updates enabled by default depending on the distribution and configuration.

**Pre-requisites:**

-   Root or sudo privileges to install updates and security software.  
    
-   Network connectivity to update repositories and download patches.  
    

**Remediation:**

### **Test Plan:**

**Using Linux command line:**

1.  Check for available updates:  
    

RPM-based systems:  

yum check-update

Debian-based systems:  

apt update

apt list --upgradable

2.  Verify installation of critical security patches and software packages.  
    
3.  Confirm presence of security software (e.g., antivirus, intrusion detection).  
    

### **Implementation Plan:**

**Using Linux command line:**

1.  Install all available updates and patches:  
    

RPM-based:  

yum update -y

Debian-based:  

apt upgrade -y

2.  Install or update security software as needed.  
    
3.  Schedule regular update checks and patch management processes.  
    

### **Backout Plan:**

**Using Linux command line:**

1.  If updates cause issues, revert to previous system state using backups or snapshots.  
    
2.  Roll back or remove problematic updates if necessary.  
    

**References:**

-   CIS Amazon Linux 2 Benchmark v3.0.0  
    
-   [NIST SP 800-53 Revision 5 - SI-2  
    ](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final#si-2)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.