A critical security patch is required on a network load balancer in a public cloud. The organization has a major sales conference next week, and the Chief Executive Officer does not want any interruptions during the demonstration of an application behind the load balancer. Which of the following approaches should the cloud security engineer take?

The scenario presents a classic conflict between a critical security need and a high-priority business requirement. The most appropriate action for a cloud security engineer is to follow a formal risk management and change control process. By asking upper management to approve an emergency patch window, the engineer properly communicates the security risk associated with the critical vulnerability. This allows business leaders, who are the ultimate risk owners, to make an informed decision. They can weigh the risk of a brief, planned outage for patching against the risk of exploitation during the conference. This approach aligns with established IT governance and security management frameworks.

A. Ask the management team to delay the conference. This oversteps the engineer's authority; suggesting the delay of a major business event is a business decision, not a technical recommendation.
B. Apply the security patch after the event. This unilaterally accepts the risk of a critical vulnerability being exploited, which is a decision that must be made and approved by management.
D. Apply the security patch immediately before the conference. This is extremely risky, as it introduces a high probability of causing an unforeseen outage or performance issue during the critical demonstration. ---

1. NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations. Control CM-3, "Configuration Change Control," mandates that organizations "Approve or disapprove configuration change requests to the system with explicit consideration for security and privacy risk." This directly supports seeking management approval for a critical patch.

2. AWS Well-Architected Framework, Operational Excellence Pillar (July 2023). The design principle "Make frequent, small, reversible changes" is relevant. However, when a critical, potentially impactful change is needed, the framework's guidance on managing operational events and evolving operations emphasizes having clear, documented processes that include risk assessment and approvals, especially for changes that can impact business-critical workloads (p. 18-21).

3. Carnegie Mellon University, IT Change Management Process. University IT policies, which serve as practical applications of academic principles, consistently define processes for emergency changes. The CMU process states, "Emergency changes are those changes that must be implemented outside of the normal change process to restore service or prevent a service outage... The Change Manager will convene an emergency meeting of the Change Advisory Board (CAB) to review the change." This mirrors the action of seeking approval from a higher authority (management team) for an emergency patch.