Identify the sample of system components observed.
Identify the related software observed on each system component.
For each item in the sample:
i. Identify the vendor security patch list reviewed.
ii. Describe how current vendor security patches for the system component and/or related software were observed to be installed.