Patch Management Basics: Inventory, Priorities, Testing and Cadence

Patching sounds simple: install updates when they arrive. In practice, small businesses run a mix of laptops, servers, cloud apps, firewalls, printers and phones, each with its own update process, and some updates break things. Without a routine, patching slips and known weaknesses stay open.

NIST's guide on the subject, SP 800-40 Revision 4, published in April 2022, frames patching as preventive maintenance for technology. It defines enterprise patch management as "the process of identifying, prioritizing, acquiring, installing, and verifying the installation of patches, updates, and upgrades throughout an organization." The FBI's 2025 IC3 annual report calls timely patching "one of the most efficient and cost-effective steps" an organization can take to reduce its exposure.

This guide turns that guidance into a routine a small team or outside IT provider can run every month.

Step 1: Know What You Have

You cannot patch what you don't know about. NIST recommends keeping software inventories up to date for all assets, and accepts that a close-to-comprehensive inventory, kept current with automated discovery, is a realistic goal. It also says the old model of updating inventories monthly or quarterly with a vulnerability scan should no longer be used.

For each device or system, NIST suggests tracking characteristics such as:

• Platform type, such as laptop, server, mobile device, cloud service or network equipment
• Who administers it: your staff, an outside provider, the vendor or the user
• The tool used to manage and update it
• Security controls already in place
• How important it is to the business
• Contractual or business restrictions, such as only being rebooted during a monthly maintenance window

Don't forget the easily missed items: firewalls, routers, Wi-Fi access points, network storage, printers, phones and cameras, plus browsers and plug-ins. For more on tracking equipment, see our guide Technology Lifecycle and IT Asset Management Basics.

Step 2: Group Devices Into Maintenance Groups

NIST recommends assigning each asset to a maintenance group, which it defines as "a set of assets with similar characteristics that generally have the same software maintenance needs." A small business might use groups such as:

• Staff laptops and desktops, which tolerate restarts outside working hours
• Servers and line-of-business systems, which need scheduled windows
• Company smartphones and tablets
• Network and security equipment
• Legacy systems that can no longer be patched

NIST advises against treating awkward systems as "exceptions." An unpatchable device still needs a plan, so it belongs in a group with its own protections.

Step 3: Prioritize With the KEV Catalog

Not every vulnerability is equally urgent. CISA's Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities that meet three criteria: an assigned CVE identifier, "reliable evidence that the vulnerability has been actively exploited in the wild," and a clear remediation action, such as a vendor update. CISA "strongly recommends all organizations review and monitor the KEV catalog and prioritize remediation of the listed vulnerabilities."

Federal civilian agencies are required to act on it. CISA's Binding Operational Directive 26-04, issued June 10, 2026, replaced the earlier directives BOD 22-01 and BOD 19-02. It sets remediation timelines using a risk matrix that considers whether an asset is publicly reachable, whether the flaw is in the KEV catalog, whether exploitation can be automated, and how much control an attacker would gain. The fastest timeline is three days. The directive does not bind private businesses, but its logic is useful.

A simple priority ladder for a small business:

1. KEV-listed flaws on internet-facing systems, such as firewalls, VPNs, remote access tools and websites: treat as emergencies.
2. KEV-listed flaws on internal systems.
3. Vendor-rated critical updates on internet-facing systems.
4. Everything else, in the routine monthly cycle.

The FBI gives the same advice: "Prioritize patching known exploited vulnerabilities in internet-facing systems."

Step 4: Test With a Pilot Group

NIST recommends phased deployments in which a small set of devices receives a patch first and acts as canaries. If problems appear, you can pause, fix them, or apply a temporary workaround before the rollout expands. NIST suggests a first round with technically capable users, followed by a broader round of early adopters who represent the wider workforce.

Even in an emergency, NIST suggests a short canary period of minutes to hours to confirm a patch isn't corrupted or broken. It also recommends allowing some flexibility for routine patches while forcing installation once a grace period ends. For servers, confirm you have a working backup before patching.

Step 5: Set a Cadence

NIST observes that routine patching lacks the urgency of an emergency and can interrupt work with reboots, so it "is often postponed and neglected." That creates more openings for attackers. It also makes later emergency patching harder, because devices may need to install earlier updates before new ones will apply. A regular, predictable cycle is the fix.

Many vendors release on a schedule. Microsoft publishes its monthly Windows security update on the second Tuesday of each month, typically at 10:00 a.m. Pacific time, commonly called Patch Tuesday. These updates are cumulative. Microsoft also releases optional preview updates in the fourth week of the month and out-of-band updates when an issue can't wait.

A workable cadence might look like this: pilot devices update within a few days of each monthly release, everyone else follows once the pilot looks clean, and servers update in a scheduled window. Separately, check the KEV catalog and vendor advisories weekly and move anything urgent into an emergency process. Let browsers and other applications that support automatic updates do so.

When You Can't Patch Right Away

NIST describes four risk responses: accept, mitigate, transfer or avoid. When a patch isn't available yet, plan an emergency mitigation, such as disabling a vulnerable feature or blocking access, and remove it once the real fix arrives. For systems that cannot be patched at all, such as equipment past its vendor's end of support, NIST recommends isolation and other long-term protections. Replacement belongs on your roadmap.

Verify and Report

Installing isn't the same as fixing. NIST's life cycle ends with verifying that each patch is installed and has taken effect, then monitoring to make sure it stays in place. Ask your team or IT provider for a short monthly report covering:

• The percentage of devices on current updates, by group
• How quickly KEV-listed issues were fixed
• Devices that failed to update, and why
• Systems on the exceptions list and their compensating protections

Key takeaways

• Treat patching as routine preventive maintenance, not an occasional emergency.
• Keep an automated, current inventory that includes network gear, printers and cloud services.
• Use CISA's KEV catalog to prioritize, starting with internet-facing systems.
• Test with a pilot group, then roll out widely on a predictable monthly cadence, with a faster path for emergencies.
• Verify installation, and isolate or replace anything that can't be patched.

Sources

• NIST, SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology (April 2022)
• CISA, Known Exploited Vulnerabilities Catalog
• CISA, Reducing the Significant Risk of Known Exploited Vulnerabilities
• CISA, BOD 26-04: Prioritizing Security Updates Based on Risk (June 10, 2026)
• Microsoft, Update release cycle for Windows clients
• FBI IC3, 2025 IC3 Annual Report