SLG IT Support

1. Purpose

 

To ensure timely remediation of vulnerabilities while maintaining system stability, PCI compliance, and uninterrupted retail operations through structured deployment and rapid business feedback.

 

 

2. Patch Categories & SLAs

 

Category	Description	Examples	Deployment SLA
Critical / Zero-Day	Actively exploited or high-risk vulnerabilities	Microsoft OOB updates, CISA KEV	24–72 hours
Security (Bi-Monthly LCU)	Standard cumulative security updates	Patch Tuesday	7–14 days
Feature Updates	OS upgrades	Windows upgrades	Planned
Third-Party Updates	Apps & tools	Chrome, Adobe, POS apps	3–7 days (critical)

 

3. Deployment Rings

 

Ring	Scope	Purpose	Timeline
Ring 0 – Test/Lab	IT systems	Technical validation	Day 0–1
Ring 1 – Pilot Stores	Selected stores + IT users	Real-world validation	Day 1–3
Ring 2 – Critical Systems	POS, payment, core infra	Business-critical protection	Day 2–5
Ring 3 – Broad Deployment	All endpoints	Full rollout	Day 5–14

 

4.  Business Feedback & Validation (MANDATORY)

 

Objective: Ensure patches do not negatively impact store operations, POS, or customer experience.

 

After Pilot Deployment (Ring 1):

 

• Within 24 hours, IT must: 

 

• Contact pilot stores (Store Managers / Key Users) 
• Validate: 
  • POS transactions (sales, returns, pinpads) 
  • Inventory lookups / scanners 
  • Payment processing 
  • Network performance 

 

• Log feedback in ticket or tracking system 

 

After Critical Systems Deployment (Ring 2):

 

• Confirm: 
  • No degradation in POS performance 
  • No increase in incidents/tickets 
• Monitor: 
  • Freshservice ticket spikes 
  • Teams/Helpdesk escalations 

 

Go/No-Go Decision Gate

 

• No broad deployment (Ring 3) without: 

 

• Positive validation from pilot stores 
• No critical/high incidents reported 
• IT Ops sign-off 

 

 

5. Emergency Patch Process (Zero-Day)

 

Triggered by:

 

• Active exploitation (Microsoft, CISA, MDR)
• Defender/Crowdstrike/Google Sec Ops alerts 
• Internal incident indicators 

 

Actions:

 

1. Validate exposure (affected systems) 
2. Deploy to Pilot immediately (same day) 
3. Accelerated feedback from stores within hours 
4. Deploy to POS & critical systems within 24–48 hrs 
5. Communicate status to leadership 

 

***In zero-day scenarios, business validation is expedited but not skipped.***

 

 

6. Standard Patch Process

 

1. Review Patch Tuesday updates 
2. Test in Ring 0 
3. Deploy to Pilot Stores 
4. Actively collect business feedback (mandatory checkpoint) 
5. Deploy to Critical Systems 
6. Broad rollout after validation 

 

 

7. Change & Risk Management

 

• All patches follow change control (standard/emergency) 
• Required before deployment: 
  • Backup / snapshot (Azure/on-prem VMs) 
  • Rollback plan 
• Avoid: 
  • Peak retail hours 
  • Promotions / high-volume periods 

 

 

8. Exclusions & Deferrals

 

Allowed only if:

• Vendor confirms incompatibility 
• Business risk outweighs security risk 

 

Must include:

• Risk acceptance 
• Compensating controls (Defender, CrowdStrike, Firewall rules) 
• Defined remediation timeline 

 

 

9. Tools & Enforcement

 

• PDQ Connect – Endpoint patching 
• Azure Update Manager – Azure Server patching 
• Defender / Crowdstrike / Google Sec Ops – Threat monitoring 
• PDQ / Automation – Third-party updates 
• Freshservice – Incident + feedback tracking 

 

 

10. Reporting & KPIs

 

• ≥ 95% compliance within SLA 
• Zero-day remediation ≤ 72 hours 
• Pilot feedback captured within 24 hours (100%) 
• Track: 
  • Incident spikes post-patch 
  • Store-reported issues 
  • Failed deployments 

 

 

11. Roles & Responsibilities

 

Role	Responsibility
IT Operations	Deployment + business validation
Store Managers / Store Ops	Provide rapid feedback post-patch
Security (MDR/SOC)	Threat identification
IT Operations	Monitor incidents + escalation
Leadership	Risk decisions