Before applying a software update to production systems, it is extremely important that

A.
Full disclosure information about the threat that the patch addresses is available

B.
The patching process is documented

C.
The production systems are backed up

D.
An independent third party attests the validity of the patch

Explanation:
C: Prior to deploying updates to production servers, make certain that a full system backup is conducted. In the regrettable event of a system crash, due to the update, the server and data can be recovered without a signifi cant loss of data. Additionally, if the update involved propriety code, it will be necessary to provide a copy of the server or application image to the media librarian. The presence or absence of full disclosure information is good to have but not a requirement as the patching process will have to be a risk-based decision as it applies to the organization. Documentation of the patching process is the last step in patch management processes. Independent third-party assessments are not usually related to attesting patch validity. Page 574.