Patch management: keep software updated without drama

Key takeaways

Patch management in a small business means applying software updates to every device and system promptly and checking they worked. Cyber Essentials requires high-risk and critical security updates to be applied within 14 days of release. A monthly routine with automatic updates, a check of what failed and a short exceptions list outsources well.

• Apply critical security updates within 14 days.
• Turn on automatic updates wherever possible.
• Check monthly which devices missed updates.
• Replace software that no longer gets updates.

Why does patching matter so much?

Many attacks exploit known weaknesses for which an update already exists. Unpatched devices, old operating systems and out-of-date website software are some of the easiest ways in. The NCSC lists keeping devices and software up to date among the most important steps a small organisation can take.

• Which business processes should you outsource?
• Cyber security without an IT department

What does a patching routine look like?

Turn on automatic updates for operating systems, browsers and common apps. Each month, check a report of which devices are behind, chase or fix them, and record exceptions. Apply critical updates faster, within 14 days. Plan replacement for devices and software that are out of support.

• Automatic updates on by default.
• Monthly report of devices behind.
• Critical updates within 14 days.
• Exceptions recorded with a reason.
• Out-of-support items replaced.

• IT asset management: know where every device is
• Outdated PHP version: what it means for your website

Which patching work can be outsourced?

Monitoring update status, applying and scheduling updates, testing important ones on a single device first, chasing users whose devices are behind and reporting monthly. The business decides when updates can cause downtime and approves replacing out-of-support systems.

• Managed security for small firms: what to outsource
• IT processes to outsource in a small business

When can patching cause problems?

Occasionally an update breaks a business-critical app. Test major updates on one device first, schedule them outside busy hours and keep a way to roll back. Delaying all updates to avoid that small risk creates a far bigger one.

• Process criticality: rate the damage if it fails
• Backup checks: test restores before you need them

What does this look like in practice?

A pattern we see: most devices update automatically, but two or three never restart, and those are the ones that stay vulnerable for months. A monthly exceptions list finds them.

• See client work
• BPO Solutions for UK businesses

Patch management checklist

Run these monthly.

• Automatic updates confirmed on all devices.
• Devices behind listed and fixed.
• Critical updates applied within 14 days.
• Website software updated.
• Out-of-support systems on a replacement plan.

• The process selection score: outsource, split or keep?
• Compliance monitoring: owners, evidence and early warnings

Next step

Tell us how many devices you have and how updates are handled today. We will suggest a routine and tell you what we could run.