DSPT Evidence: Patching schedule or IT supplier confirmation of automatic patching
unattended-upgrades applies OS security patches automatically every night. No manual intervention required.
Verification:
/etc/apt/apt.conf.d/20auto-upgrades → Unattended-Upgrade "1"
Watchtower runs as a container and automatically checks for image updates, pulls new versions, and restarts containers with the latest secure images.
Verification:
docker ps → Watchtower container active
Trivy scans all running Docker images weekly:
| Detail | Value |
|---|---|
| Schedule | Every Sunday at 3am |
| Script | /opt/security-scanner-scripts/scan_trivy_weekly.sh |
| Output | /tmp/trivy-scans/trivy_<image>_<date>.json |
| Log | /var/log/trivy-weekly.log |
| Dashboard | security.veripath.co.uk/dashboard/ |
The Security Dashboard reads scan results automatically. Critical and High severity findings are remediated following the procedure in /operations/remediation/container-image-upgrade.
When Trivy reports vulnerabilities:
/operations/remediation/container-image-upgrade)/operations/remediation/upstream-trackerWorked example (24 May 2026): nginx:1.25 → nginx:stable reduced total vulnerabilities by 94% (465 → 29) and eliminated all Criticals (16 → 0).
| Evidence | Location |
|---|---|
| Patching schedule | This page (/policies/standard_9b) |
| Auto-upgrade config | /etc/apt/apt.conf.d/20auto-upgrades |
| Weekly scan results | /var/log/trivy-weekly.log / Security Dashboard |
| Remediation guide | /operations/remediation/container-image-upgrade |
| Upstream tracker | /operations/remediation/upstream-tracker |
| Watchtower active | docker ps |