Patch management is formally governed by change control management because updates modify the production environment and must be planned, tested, and authorized. Contingency and business continuity planning focus on disaster recovery, while system update management is a task, not the parent framework.