Vendors preventing proactive security patches

I work for a large healthcare organisation, that manages approximately 40k endpoints.

Mandated by ISO27001 and DSPT there is a patching policy enforced by my organisation, to patch and update the OS, and additionally, vulnerability scans on endpoints to prevent EOL software as part of the SDLC.

One of the requirements is completing software and hardware risk assessments, now as I work in a clinical organisation we have to balance patient care against cyber risks.

As part of the hardware …

cybersecurity endpoints eol healthcare iso27001 large organisation patch patches patching patching policy policy proactive proactive security requirements scans sdlc security security patches software update vendors vulnerability vulnerability scans work