The Maersk case shows that inadequate patch management and lack of network isolation can contribute to rapid malware spread and severe operational disruption.

### Why this is right The material identifies inadequate patch management and insufficient network isolation as governance weaknesses in the Maersk case. The NotPetya attack spread widely and disrupted operations at more than 600 ports. ### The concept Patch management is the organized process of applying updates that address known software issues. Network isolation limits connections between systems, reducing the chance that malware in one area will spread throughout an organization. Neither measure guarantees prevention, so incident response and recovery planning remain necessary. ### Terms - **Patch management**: Identifying, testing, and applying software updates to maintain systems and address known weaknesses. - **Network isolation**: Separating systems or network areas so that a compromise is less able to spread. - **NotPetya**: The ransomware attack named in the course material as the cause of major disruption to Maersk in 2017. ### Remember Keep systems updated and limit unnecessary connections to reduce the spread and impact of malware.