Cyber Security GuidesChecklist and Guide

Vulnerability Patch Wave Readiness Checklist

8 minutes to completeEvergreen guide — kept up to date

AI is helping security researchers find software vulnerabilities faster. Use this checklist to determine whether your organisation can prioritise, test and deploy the resulting patches safely.

Assets

□ Record every device
□ Record operating systems
□ Record installed applications
□ Record network equipment
□ Record cloud services and SaaS applications
□ Assign an owner to every asset

Exposure

□ Identify internet-facing systems
□ Identify remote-access services
□ Identify business-critical systems
□ Record systems holding sensitive data

Updates

□ Enable managed operating-system updates
□ Enable browser updates
□ Patch third-party applications
□ Review firmware on network devices
□ Monitor vendor security advisories

Prioritisation

□ Check active exploitation before prioritising
□ Check severity and system exposure
□ Check business impact of both the vulnerability and the patch
□ Check available compensating controls

Testing

□ Maintain test devices for critical application assessment
□ Test critical applications before production deployment
□ Check authentication after updates
□ Check remote access after updates
□ Confirm rollback is possible before deploying

Deployment

□ Define emergency timescales for actively exploited vulnerabilities
□ Schedule routine update cycles
□ Cover remote and home-working devices
□ Report and investigate failed updates
□ Verify installed versions after deployment

Exceptions

□ Document all unpatched systems
□ Identify a risk owner for each exception
□ Apply compensating controls
□ Set a target resolution date

Support

□ Replace unsupported software and firmware
□ Confirm supplier patch responsibilities
□ Test backups and verify restores
□ Review the patch-management process regularly

A growing number of patches is manageable only where the organisation knows what it operates and who is responsible for updating it.

Plain-English Takeaway

Patch management must cover all devices, third-party software, firmware, cloud services and network equipment — not Windows computers alone. Define patch timescales by risk, test critical updates, verify deployment, document exceptions with owners and resolution dates, and replace unsupported systems.

Downloadable guide