Patch management: staying current without breaking production.

Unpatched software is how many attacks start. Patching carelessly is how many outages start. A process handles both.

Know what you have

You cannot patch what you have not listed. Keep an asset register with operating system, applications and firmware versions.

Rank by risk

Prioritise internet-facing systems, remote access, firewalls, email and anything with a known exploited vulnerability. Others follow a regular cycle.

Use rings

Test on a few machines, then a pilot group, then everyone. Hold back critical servers until they pass testing.

Schedule

Agree maintenance windows with the business. Servers and plant systems often need planned downtime.

Firmware too

Switches, firewalls, cameras and recorders need firmware updates. They are often forgotten, and often exposed.

Roll back

Take backups or snapshots before changes, and know how to undo them.

When you cannot patch

Legacy or certified systems may not accept updates. Isolate them on separate networks, restrict access and monitor them.

Report

Show the share of devices current, exceptions and age of the oldest missing patch each month.