The asset owner shall have policies and procedures related to the documentation and maintenance of the security patch status of all components.