[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVBZAZK51GMSRGRKB7M9ST":3,"skill-same:01M6EVBZAZK51GMSRGRKB7M9ST":112},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":73,"commitSha":74,"skillDirectory":75,"forksCount":14,"repositoryHtmlUrl":76,"repositoryHomepageUrl":77,"ownerHtmlUrl":78,"ownerBlogUrl":6,"ownerDescription":79,"updatedAt":80,"install":81,"resources":94},"01M6EVBZAZK51GMSRGRKB7M9ST","implementing-patch-management-for-ot-systems",null,"This skill covers implementing a structured patch management program for OT\u002FICS environments where traditional IT patching approaches can cause process disruption or safety hazards. It addresses vendor compatibility testing, risk-based patch prioritization, staged deployment through test environments, maintenance window coordination, rollback procedures, and compensating controls when patches cannot be applied due to operational constraints or vendor restrictions.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-patch-management-for-ot-systems\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"systems","patch","management","implementing patch management for ot systems","patching","de","compatibility","cm","coordination","prioritization","vulnerability","testing","ICS-security","Safety","risk","t1078","vulnerability-management","patch-management","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: implementing-patch-management-for-ot-systems\ndescription: 'This skill covers implementing a structured patch management program\n  for OT\u002FICS environments where traditional IT patching approaches can cause process\n  disruption or safety hazards. It addresses vendor compatibility testing, risk-based\n  patch prioritization, staged deployment through test environments, maintenance window\n  coordination, rollback procedures, and compensating controls when patches cannot\n  be applied due to operational constraints or vendor restrictions.\n\n  '\ndomain: cybersecurity\nsubdomain: ot-ics-security\ntags:\n- ot-security\n- ics\n- scada\n- industrial-control\n- iec62443\n- patch-management\n- vulnerability-management\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-05\n- GV.OC-02\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T0816\n- T0836\n---\n\n# Implementing Patch Management for OT Systems\n\n## When to Use\n\n- When establishing a formal OT patch management program for the first time\n- When responding to critical ICS-CERT advisories affecting deployed OT systems\n- When preparing for NERC CIP-007-6 or IEC 62443 patch management compliance audits\n- When planning patch deployment during limited maintenance windows in continuous operations\n- When evaluating compensating controls for systems that cannot be patched\n\n**Do not use** for IT-only patch management without OT considerations, for emergency patching during active cyber incidents (see performing-ot-incident-response), or for firmware upgrades that change PLC functionality (requires separate change management).\n\n## Prerequisites\n\n- OT asset inventory with firmware\u002FOS versions for all patchable systems\n- Vendor patch notification subscriptions (Siemens ProductCERT, Rockwell, Schneider, etc.)\n- Test\u002Fstaging environment mirroring production OT systems for patch validation\n- Maintenance window schedule aligned with process shutdowns and turnarounds\n- Change management board approval process including operations and safety representatives\n\n## Workflow\n\n### Step 1: Establish OT Patch Management Program\n\nDefine the patch management lifecycle adapted for OT environments where availability and safety take priority over immediate vulnerability remediation.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"OT Patch Management Program Manager.\n\nTracks patches for OT systems, manages risk-based prioritization,\ncoordinates testing and deployment, and documents compensating\ncontrols for unpatchable systems.\n\"\"\"\n\nimport json\nimport sys\nfrom collections import defaultdict\nfrom dataclasses import dataclass, field, asdict\nfrom datetime import datetime, timedelta\nfrom enum import Enum\n\n\nclass PatchStatus(str, Enum):\n    IDENTIFIED = \"identified\"\n    EVALUATING = \"evaluating\"\n    TESTING = \"testing\"\n    APPROVED = \"approved\"\n    SCHEDULED = \"scheduled\"\n    DEPLOYED = \"deployed\"\n    DEFERRED = \"deferred\"\n    NOT_APPLICABLE = \"not_applicable\"\n\n\n@dataclass\nclass OTPatch:\n    patch_id: str\n    vendor: str\n    product: str\n    affected_versions: str\n    cve_ids: list\n    cvss_score: float\n    ics_cert_advisory: str\n    description: str\n    status: str = PatchStatus.IDENTIFIED\n    identified_date: str = \"\"\n    evaluation_deadline: str = \"\"  # 35 days per CIP-007\n    test_date: str = \"\"\n    deployment_date: str = \"\"\n    affected_assets: list = field(default_factory=list)\n    test_results: str = \"\"\n    compensating_controls: str = \"\"\n    risk_rating: str = \"\"\n    maintenance_window: str = \"\"\n    rollback_procedure: str = \"\"\n\n\nclass OTPatchManager:\n    \"\"\"Manages the OT patch lifecycle.\"\"\"\n\n    def __init__(self):\n        self.patches = []\n        self.assets = {}\n        self.vendor_feeds = {}\n\n    def add_patch(self, patch: OTPatch):\n        \"\"\"Register a new patch for tracking.\"\"\"\n        # Set evaluation deadline (35 calendar days per NERC CIP-007)\n        if not patch.evaluation_deadline:\n            identified = datetime.fromisoformat(patch.identified_date)\n            patch.evaluation_deadline = (identified + timedelta(days=35)).isoformat()\n\n        self.patches.append(patch)\n\n    def prioritize_patches(self):\n        \"\"\"Risk-based prioritization for OT patches.\"\"\"\n        for patch in self.patches:\n            if patch.status in (PatchStatus.DEPLOYED, PatchStatus.NOT_APPLICABLE):\n                continue\n\n            # OT-specific risk scoring\n            score = patch.cvss_score\n\n            # Increase priority for actively exploited vulnerabilities\n            if \"CISA KEV\" in patch.ics_cert_advisory:\n                score += 2.0\n\n            # Increase priority for network-exposed OT systems\n            for asset_id in patch.affected_assets:\n                asset = self.assets.get(asset_id, {})\n                if asset.get(\"network_exposed\"):\n                    score += 1.0\n                if asset.get(\"purdue_level\") in (\"Level 0-1\", \"Level 2\"):\n                    score += 1.5\n\n            score = min(score, 10.0)\n\n            if score >= 9.0:\n                patch.risk_rating = \"critical\"\n            elif score >= 7.0:\n                patch.risk_rating = \"high\"\n            elif score >= 4.0:\n                patch.risk_rating = \"medium\"\n            else:\n                patch.risk_rating = \"low\"\n\n    def get_patches_needing_evaluation(self):\n        \"\"\"Get patches approaching evaluation deadline.\"\"\"\n        now = datetime.now()\n        approaching = []\n        for patch in self.patches:\n            if patch.status == PatchStatus.IDENTIFIED:\n                deadline = datetime.fromisoformat(patch.evaluation_deadline)\n                days_remaining = (deadline - now).days\n                if days_remaining \u003C= 7:\n                    approaching.append((patch, days_remaining))\n        return sorted(approaching, key=lambda x: x[1])\n\n    def defer_patch(self, patch_id, reason, compensating_controls):\n        \"\"\"Defer a patch with documented compensating controls.\"\"\"\n        for patch in self.patches:\n            if patch.patch_id == patch_id:\n                patch.status = PatchStatus.DEFERRED\n                patch.compensating_controls = compensating_controls\n                patch.test_results = f\"Deferred: {reason}\"\n                break\n\n    def generate_report(self):\n        \"\"\"Generate patch management status report.\"\"\"\n        self.prioritize_patches()\n\n        report = []\n        report.append(\"=\" * 70)\n        report.append(\"OT PATCH MANAGEMENT STATUS REPORT\")\n        report.append(f\"Date: {datetime.now().isoformat()}\")\n        report.append(\"=\" * 70)\n\n        # Status summary\n        status_counts = defaultdict(int)\n        for p in self.patches:\n            status_counts[p.status] += 1\n\n        report.append(\"\\nPATCH STATUS SUMMARY:\")\n        for status, count in status_counts.items():\n            report.append(f\"  {status}: {count}\")\n\n        # Approaching deadlines\n        approaching = self.get_patches_needing_evaluation()\n        if approaching:\n            report.append(\"\\nAPPROACHING EVALUATION DEADLINES:\")\n            for patch, days in approaching:\n                report.append(f\"  [{patch.patch_id}] {patch.description} - {days} days remaining\")\n\n        # Critical\u002FHigh priority patches\n        urgent = [p for p in self.patches\n                  if p.risk_rating in (\"critical\", \"high\")\n                  and p.status not in (PatchStatus.DEPLOYED, PatchStatus.NOT_APPLICABLE)]\n        if urgent:\n            report.append(f\"\\nURGENT PATCHES ({len(urgent)}):\")\n            for p in urgent:\n                report.append(f\"  [{p.patch_id}] [{p.risk_rating.upper()}] {p.description}\")\n                report.append(f\"    CVEs: {', '.join(p.cve_ids)}\")\n                report.append(f\"    Status: {p.status}\")\n                report.append(f\"    Affected Assets: {len(p.affected_assets)}\")\n\n        # Deferred patches with compensating controls\n        deferred = [p for p in self.patches if p.status == PatchStatus.DEFERRED]\n        if deferred:\n            report.append(f\"\\nDEFERRED PATCHES ({len(deferred)}):\")\n            for p in deferred:\n                report.append(f\"  [{p.patch_id}] {p.description}\")\n                report.append(f\"    Reason: {p.test_results}\")\n                report.append(f\"    Compensating Controls: {p.compensating_controls}\")\n\n        return \"\\n\".join(report)\n\n\nif __name__ == \"__main__\":\n    manager = OTPatchManager()\n\n    # Example patches\n    manager.add_patch(OTPatch(\n        patch_id=\"OT-PATCH-001\",\n        vendor=\"Siemens\",\n        product=\"SIMATIC S7-1500\",\n        affected_versions=\"\u003C V3.0.1\",\n        cve_ids=[\"CVE-2023-44374\"],\n        cvss_score=8.8,\n        ics_cert_advisory=\"ICSA-23-348-01\",\n        description=\"S7-1500 memory corruption via crafted packets\",\n        identified_date=\"2026-01-15\",\n        affected_assets=[\"PLC-01\", \"PLC-02\", \"PLC-03\"],\n    ))\n\n    manager.add_patch(OTPatch(\n        patch_id=\"OT-PATCH-002\",\n        vendor=\"Rockwell Automation\",\n        product=\"FactoryTalk View SE\",\n        affected_versions=\"\u003C V13.0\",\n        cve_ids=[\"CVE-2024-21914\"],\n        cvss_score=7.5,\n        ics_cert_advisory=\"ICSA-24-046-02\",\n        description=\"FactoryTalk View remote code execution\",\n        identified_date=\"2026-02-01\",\n        affected_assets=[\"HMI-01\", \"HMI-02\"],\n    ))\n\n    print(manager.generate_report())\n```\n\n### Step 2: Test Patches in Staging Environment\n\nNever deploy patches directly to production OT systems. Use a test environment that mirrors production to validate patch compatibility.\n\n```yaml\n# OT Patch Testing Procedure\npatch_testing:\n  environment:\n    description: \"Staging lab mirroring production OT architecture\"\n    components:\n      - \"Virtual PLC simulators matching production firmware\"\n      - \"Test HMI stations with identical software versions\"\n      - \"Test historian with representative data\"\n      - \"Network configuration matching production VLANs\u002Ffirewalls\"\n\n  test_cases:\n    functional:\n      - \"PLC programs execute correctly after OS patch\"\n      - \"HMI displays update with correct process values\"\n      - \"Historian data collection continues uninterrupted\"\n      - \"Alarm and event handling functions properly\"\n      - \"Communication between PLCs maintains cycle time\"\n      - \"Safety system trip tests pass (if SIS affected)\"\n\n    performance:\n      - \"PLC scan time remains within acceptable limits (\u003C50ms increase)\"\n      - \"HMI screen refresh rate unchanged\"\n      - \"Historian collection interval maintained\"\n      - \"Network latency between zones unchanged\"\n\n    compatibility:\n      - \"Third-party applications function correctly\"\n      - \"OPC UA\u002FDA connections establish successfully\"\n      - \"Custom scripts and batch processes execute\"\n      - \"Backup and restore procedures work\"\n\n    rollback:\n      - \"System can be reverted to pre-patch state\"\n      - \"Rollback procedure documented and tested\"\n      - \"Estimated rollback time: [N] minutes\"\n\n  documentation:\n    required:\n      - \"Test plan with pass\u002Ffail criteria\"\n      - \"Test execution results with screenshots\"\n      - \"Performance measurements before and after\"\n      - \"Sign-off by operations, engineering, and security\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Compensating Control | Alternative security measure applied when a patch cannot be deployed, such as firewall rules, IPS signatures, or network isolation |\n| Vendor Compatibility | Confirmation from the OT vendor that a patch (especially OS patches) is compatible with their control system software |\n| Maintenance Window | Scheduled period for system modifications, aligned with process shutdowns or reduced-risk operational periods |\n| Virtual Patching | Deploying IDS\u002FIPS rules to detect and block exploitation attempts for known vulnerabilities without modifying the target system |\n| Evaluation Deadline | NERC CIP-007-6 requires patch evaluation within 35 calendar days of availability |\n| Turnaround | Major scheduled shutdown of a process unit for maintenance, providing opportunity for extensive OT patching |\n\n## Tools & Systems\n\n- **WSUS\u002FSCCM**: Microsoft patch management for Windows-based OT systems (HMIs, historians, engineering workstations)\n- **Siemens ProductCERT**: Siemens security advisory service for industrial products\n- **Claroty xDome**: OT vulnerability management with patch availability tracking and risk scoring\n- **Tripwire Enterprise**: Configuration monitoring detecting unauthorized changes and tracking patch status\n\n## Output Format\n\n```\nOT Patch Management Report\n============================\nReporting Period: YYYY-MM to YYYY-MM\n\nPATCH STATUS:\n  Identified: [N]\n  Evaluating: [N]\n  Testing: [N]\n  Deployed: [N]\n  Deferred: [N]\n\nCOMPLIANCE:\n  Evaluated within 35 days: [N]\u002F[N] (CIP-007-6 R2)\n  Deployed or mitigated: [N]\u002F[N]\n  Deferred with compensating controls: [N]\n```\n","# Implementing Patch Management for OT Systems\n\n## When to Use\n\n- When establishing a formal OT patch management program for the first time\n- When responding to critical ICS-CERT advisories affecting deployed OT systems\n- When preparing for NERC CIP-007-6 or IEC 62443 patch management compliance audits\n- When planning patch deployment during limited maintenance windows in continuous operations\n- When evaluating compensating controls for systems that cannot be patched\n\n**Do not use** for IT-only patch management without OT considerations, for emergency patching during active cyber incidents (see performing-ot-incident-response), or for firmware upgrades that change PLC functionality (requires separate change management).\n\n## Prerequisites\n\n- OT asset inventory with firmware\u002FOS versions for all patchable systems\n- Vendor patch notification subscriptions (Siemens ProductCERT, Rockwell, Schneider, etc.)\n- Test\u002Fstaging environment mirroring production OT systems for patch validation\n- Maintenance window schedule aligned with process shutdowns and turnarounds\n- Change management board approval process including operations and safety representatives\n\n## Workflow\n\n### Step 1: Establish OT Patch Management Program\n\nDefine the patch management lifecycle adapted for OT environments where availability and safety take priority over immediate vulnerability remediation.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"OT Patch Management Program Manager.\n\nTracks patches for OT systems, manages risk-based prioritization,\ncoordinates testing and deployment, and documents compensating\ncontrols for unpatchable systems.\n\"\"\"\n\nimport json\nimport sys\nfrom collections import defaultdict\nfrom dataclasses import dataclass, field, asdict\nfrom datetime import datetime, timedelta\nfrom enum import Enum\n\n\nclass PatchStatus(str, Enum):\n    IDENTIFIED = \"identified\"\n    EVALUATING = \"evaluating\"\n    TESTING = \"testing\"\n    APPROVED = \"approved\"\n    SCHEDULED = \"scheduled\"\n    DEPLOYED = \"deployed\"\n    DEFERRED = \"deferred\"\n    NOT_APPLICABLE = \"not_applicable\"\n\n\n@dataclass\nclass OTPatch:\n    patch_id: str\n    vendor: str\n    product: str\n    affected_versions: str\n    cve_ids: list\n    cvss_score: float\n    ics_cert_advisory: str\n    description: str\n    status: str = PatchStatus.IDENTIFIED\n    identified_date: str = \"\"\n    evaluation_deadline: str = \"\"  # 35 days per CIP-007\n    test_date: str = \"\"\n    deployment_date: str = \"\"\n    affected_assets: list = field(default_factory=list)\n    test_results: str = \"\"\n    compensating_controls: str = \"\"\n    risk_rating: str = \"\"\n    maintenance_window: str = \"\"\n    rollback_procedure: str = \"\"\n\n\nclass OTPatchManager:\n    \"\"\"Manages the OT patch lifecycle.\"\"\"\n\n    def __init__(self):\n        self.patches = []\n        self.assets = {}\n        self.vendor_feeds = {}\n\n    def add_patch(self, patch: OTPatch):\n        \"\"\"Register a new patch for tracking.\"\"\"\n        # Set evaluation deadline (35 calendar days per NERC CIP-007)\n        if not patch.evaluation_deadline:\n            identified = datetime.fromisoformat(patch.identified_date)\n            patch.evaluation_deadline = (identified + timedelta(days=35)).isoformat()\n\n        self.patches.append(patch)\n\n    def prioritize_patches(self):\n        \"\"\"Risk-based prioritization for OT patches.\"\"\"\n        for patch in self.patches:\n            if patch.status in (PatchStatus.DEPLOYED, PatchStatus.NOT_APPLICABLE):\n                continue\n\n            # OT-specific risk scoring\n            score = patch.cvss_score\n\n            # Increase priority for actively exploited vulnerabilities\n            if \"CISA KEV\" in patch.ics_cert_advisory:\n                score += 2.0\n\n            # Increase priority for network-exposed OT systems\n            for asset_id in patch.affected_assets:\n                asset = self.assets.get(asset_id, {})\n                if asset.get(\"network_exposed\"):\n                    score += 1.0\n                if asset.get(\"purdue_level\") in (\"Level 0-1\", \"Level 2\"):\n                    score += 1.5\n\n            score = min(score, 10.0)\n\n            if score >= 9.0:\n                patch.risk_rating = \"critical\"\n            elif score >= 7.0:\n                patch.risk_rating = \"high\"\n            elif score >= 4.0:\n                patch.risk_rating = \"medium\"\n            else:\n                patch.risk_rating = \"low\"\n\n    def get_patches_needing_evaluation(self):\n        \"\"\"Get patches approaching evaluation deadline.\"\"\"\n        now = datetime.now()\n        approaching = []\n        for patch in self.patches:\n            if patch.status == PatchStatus.IDENTIFIED:\n                deadline = datetime.fromisoformat(patch.evaluation_deadline)\n                days_remaining = (deadline - now).days\n                if days_remaining \u003C= 7:\n                    approaching.append((patch, days_remaining))\n        return sorted(approaching, key=lambda x: x[1])\n\n    def defer_patch(self, patch_id, reason, compensating_controls):\n        \"\"\"Defer a patch with documented compensating controls.\"\"\"\n        for patch in self.patches:\n            if patch.patch_id == patch_id:\n                patch.status = PatchStatus.DEFERRED\n                patch.compensating_controls = compensating_controls\n                patch.test_results = f\"Deferred: {reason}\"\n                break\n\n    def generate_report(self):\n        \"\"\"Generate patch management status report.\"\"\"\n        self.prioritize_patches()\n\n        report = []\n        report.append(\"=\" * 70)\n        report.append(\"OT PATCH MANAGEMENT STATUS REPORT\")\n        report.append(f\"Date: {datetime.now().isoformat()}\")\n        report.append(\"=\" * 70)\n\n        # Status summary\n        status_counts = defaultdict(int)\n        for p in self.patches:\n            status_counts[p.status] += 1\n\n        report.append(\"\\nPATCH STATUS SUMMARY:\")\n        for status, count in status_counts.items():\n            report.append(f\"  {status}: {count}\")\n\n        # Approaching deadlines\n        approaching = self.get_patches_needing_evaluation()\n        if approaching:\n            report.append(\"\\nAPPROACHING EVALUATION DEADLINES:\")\n            for patch, days in approaching:\n                report.append(f\"  [{patch.patch_id}] {patch.description} - {days} days remaining\")\n\n        # Critical\u002FHigh priority patches\n        urgent = [p for p in self.patches\n                  if p.risk_rating in (\"critical\", \"high\")\n                  and p.status not in (PatchStatus.DEPLOYED, PatchStatus.NOT_APPLICABLE)]\n        if urgent:\n            report.append(f\"\\nURGENT PATCHES ({len(urgent)}):\")\n            for p in urgent:\n                report.append(f\"  [{p.patch_id}] [{p.risk_rating.upper()}] {p.description}\")\n                report.append(f\"    CVEs: {', '.join(p.cve_ids)}\")\n                report.append(f\"    Status: {p.status}\")\n                report.append(f\"    Affected Assets: {len(p.affected_assets)}\")\n\n        # Deferred patches with compensating controls\n        deferred = [p for p in self.patches if p.status == PatchStatus.DEFERRED]\n        if deferred:\n            report.append(f\"\\nDEFERRED PATCHES ({len(deferred)}):\")\n            for p in deferred:\n                report.append(f\"  [{p.patch_id}] {p.description}\")\n                report.append(f\"    Reason: {p.test_results}\")\n                report.append(f\"    Compensating Controls: {p.compensating_controls}\")\n\n        return \"\\n\".join(report)\n\n\nif __name__ == \"__main__\":\n    manager = OTPatchManager()\n\n    # Example patches\n    manager.add_patch(OTPatch(\n        patch_id=\"OT-PATCH-001\",\n        vendor=\"Siemens\",\n        product=\"SIMATIC S7-1500\",\n        affected_versions=\"\u003C V3.0.1\",\n        cve_ids=[\"CVE-2023-44374\"],\n        cvss_score=8.8,\n        ics_cert_advisory=\"ICSA-23-348-01\",\n        description=\"S7-1500 memory corruption via crafted packets\",\n        identified_date=\"2026-01-15\",\n        affected_assets=[\"PLC-01\", \"PLC-02\", \"PLC-03\"],\n    ))\n\n    manager.add_patch(OTPatch(\n        patch_id=\"OT-PATCH-002\",\n        vendor=\"Rockwell Automation\",\n        product=\"FactoryTalk View SE\",\n        affected_versions=\"\u003C V13.0\",\n        cve_ids=[\"CVE-2024-21914\"],\n        cvss_score=7.5,\n        ics_cert_advisory=\"ICSA-24-046-02\",\n        description=\"FactoryTalk View remote code execution\",\n        identified_date=\"2026-02-01\",\n        affected_assets=[\"HMI-01\", \"HMI-02\"],\n    ))\n\n    print(manager.generate_report())\n```\n\n### Step 2: Test Patches in Staging Environment\n\nNever deploy patches directly to production OT systems. Use a test environment that mirrors production to validate patch compatibility.\n\n```yaml\n# OT Patch Testing Procedure\npatch_testing:\n  environment:\n    description: \"Staging lab mirroring production OT architecture\"\n    components:\n      - \"Virtual PLC simulators matching production firmware\"\n      - \"Test HMI stations with identical software versions\"\n      - \"Test historian with representative data\"\n      - \"Network configuration matching production VLANs\u002Ffirewalls\"\n\n  test_cases:\n    functional:\n      - \"PLC programs execute correctly after OS patch\"\n      - \"HMI displays update with correct process values\"\n      - \"Historian data collection continues uninterrupted\"\n      - \"Alarm and event handling functions properly\"\n      - \"Communication between PLCs maintains cycle time\"\n      - \"Safety system trip tests pass (if SIS affected)\"\n\n    performance:\n      - \"PLC scan time remains within acceptable limits (\u003C50ms increase)\"\n      - \"HMI screen refresh rate unchanged\"\n      - \"Historian collection interval maintained\"\n      - \"Network latency between zones unchanged\"\n\n    compatibility:\n      - \"Third-party applications function correctly\"\n      - \"OPC UA\u002FDA connections establish successfully\"\n      - \"Custom scripts and batch processes execute\"\n      - \"Backup and restore procedures work\"\n\n    rollback:\n      - \"System can be reverted to pre-patch state\"\n      - \"Rollback procedure documented and tested\"\n      - \"Estimated rollback time: [N] minutes\"\n\n  documentation:\n    required:\n      - \"Test plan with pass\u002Ffail criteria\"\n      - \"Test execution results with screenshots\"\n      - \"Performance measurements before and after\"\n      - \"Sign-off by operations, engineering, and security\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Compensating Control | Alternative security measure applied when a patch cannot be deployed, such as firewall rules, IPS signatures, or network isolation |\n| Vendor Compatibility | Confirmation from the OT vendor that a patch (especially OS patches) is compatible with their control system software |\n| Maintenance Window | Scheduled period for system modifications, aligned with process shutdowns or reduced-risk operational periods |\n| Virtual Patching | Deploying IDS\u002FIPS rules to detect and block exploitation attempts for known vulnerabilities without modifying the target system |\n| Evaluation Deadline | NERC CIP-007-6 requires patch evaluation within 35 calendar days of availability |\n| Turnaround | Major scheduled shutdown of a process unit for maintenance, providing opportunity for extensive OT patching |\n\n## Tools & Systems\n\n- **WSUS\u002FSCCM**: Microsoft patch management for Windows-based OT systems (HMIs, historians, engineering workstations)\n- **Siemens ProductCERT**: Siemens security advisory service for industrial products\n- **Claroty xDome**: OT vulnerability management with patch availability tracking and risk scoring\n- **Tripwire Enterprise**: Configuration monitoring detecting unauthorized changes and tracking patch status\n\n## Output Format\n\n```\nOT Patch Management Report\n============================\nReporting Period: YYYY-MM to YYYY-MM\n\nPATCH STATUS:\n  Identified: [N]\n  Evaluating: [N]\n  Testing: [N]\n  Deployed: [N]\n  Deferred: [N]\n\nCOMPLIANCE:\n  Evaluated within 35 days: [N]\u002F[N] (CIP-007-6 R2)\n  Deployed or mitigated: [N]\u002F[N]\n  Deferred with compensating controls: [N]\n```\n",{"name":5,"tags":52,"author":58,"domain":45,"license":15,"version":59,"nist_csf":60,"subdomain":65,"description":66,"mitre_attack":67},[53,54,55,56,57,44,43],"ot-security","ics","scada","industrial-control","iec62443","mahipal","1.0.0",[61,62,63,64],"PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02","ot-ics-security","This skill covers implementing a structured patch management program for OT\u002FICS environments where traditional IT patching approaches can cause process disruption or safety hazards. It addresses vendor compatibility testing, risk-based patch prioritization, staged deployment through test environments, maintenance window coordination, rollback procedures, and compensating controls when patches cannot be applied due to operational constraints or vendor restrictions.\n",[68,69,70,71,72],"T1078","T1190","T1059","T0816","T0836","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fimplementing-patch-management-for-ot-systems","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":82,"prompt":92,"zipAvailable":93},[83,86,89],{"tool":84,"command":85},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill implementing-patch-management-for-ot-systems",{"tool":87,"command":88},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill implementing-patch-management-for-ot-systems",{"tool":90,"command":91},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill implementing-patch-management-for-ot-systems","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-patch-management-for-ot-systems\u002FSKILL.md",true,[95,100,106],{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-patch-management-for-ot-systems\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",2974,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-patch-management-for-ot-systems\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"scripts\u002Fagent.py","SCRIPT","脚本",3615,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-patch-management-for-ot-systems\u002Fscripts\u002Fagent.py",[113,154,163,172,194,220],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":134,"publishedAt":47},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[120,123,126,129],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":130,"categoryName":131,"taxonomyType":132,"taxonomyTypeDesc":133},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[115,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":155,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":162,"publishedAt":47},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[158,159,160,161],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":130,"categoryName":131,"taxonomyType":132,"taxonomyTypeDesc":133},[115,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153],{"skillNo":164,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":171,"publishedAt":47},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[167,168,169,170],{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":124,"categoryName":125,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":127,"categoryName":128,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":130,"categoryName":131,"taxonomyType":132,"taxonomyTypeDesc":133},[115,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153],{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":178,"publishedAt":47},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[179,180,181,182,183,184,185,186,187,188,189,190,191,192,193],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":201,"publishedAt":47},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[200],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[202,203,204,205,206,207,208,209,210,211,212,146,147,213,214,215,216,217,218,219],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":221,"name":222,"nameZh":6,"description":223,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":6,"sourceHtmlUrl":224,"categories":225,"keywords":236,"publishedAt":47},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[226,229,232,233],{"categoryNo":227,"categoryName":228,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":230,"categoryName":231,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":234,"categoryName":235,"taxonomyType":132,"taxonomyTypeDesc":133},"01JBSEEDCAT000000000000036","内容创作者",[237,238,239,240,241,242,243,244,143,245,146,147,148,246,247,248,249,250,193,251],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]