Requirement 6: Develop and maintain secure systems

Target maintained patch management processes - The requirement was met on paper - However, the specific exploitation path used by the attackers did not rely on unpatched software --- it relied on credential theft and network architecture weaknesses