Exchange must have the most current, approved Cumulative Update (CU) installed.

The organization (including any contractor to the organization) must promptly install security-relevant software updates (e.g., patches, service packs, CUs, hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed.