Editorial · October 19, 2026
Patch Management: Keeping Business Software Updated
Patch management means keeping the software your business uses up to date, so known security holes get closed before someone uses them. You do not need a big team to do it well. You need a short list, a steady routine and a plan for the days when something urgent comes up.
This checklist is for small and mid-size businesses. It follows the ideas in a guide from the National Institute of Standards and Technology, written for large organizations, and scales them down.
What a patch is, and why it matters
A patch is an update from a software maker that fixes a flaw. Some flaws are just bugs. Others let an attacker break in. NIST describes patching as preventive maintenance for technology, much like the upkeep a company does on its fleet vehicles to avoid costly breakdowns. It costs time, but it costs less than a breakdown.
The same guide defines the full job as identifying, prioritizing, acquiring, installing and verifying patches. That is five steps, not one. Many businesses only do the install step and skip the rest.
Step 1: List your software and devices
You cannot update what you do not know you have. Start with a simple sheet. For each item, write the name, the version, who owns it and where it runs. Include laptops, phones, servers, the office router, web plugins and cloud tools.
NIST says a complete list of everything may be impossible to reach. Aim for close to complete, and add new items as you find them. NIST warns that an inventory goes stale fast, so update the list whenever you add or retire something.
Step 2: Sort items into groups
Do not treat every item the same. NIST suggests putting items with similar traits into a maintenance group. A business might use three groups: office laptops, servers that face the internet, and special equipment such as a point-of-sale terminal.
Each group gets its own rules. Laptops can update at night. A register that runs all day may need a quiet hour on Sunday. Writing this down once saves arguments later.
Step 3: Test, then install on a schedule
For routine patches, pick a fixed day each month and stick to it. NIST calls this routine patching: the standard way to handle updates that come out on a regular cycle. Most of your patching will fall here.
Test first on one or two machines. If nothing breaks, roll the update out to the rest of the group. Keep a note of what you changed and when, so you can undo it if needed. NIST also warns that putting off routine patching makes urgent patching harder later, because more updates pile up.
Step 4: Plan for urgent fixes
Some flaws cannot wait for the monthly day. NIST names this emergency patching, and it is the second plan to write. Decide ahead of time who can approve a rush update and how fast it must happen.
The U.S. Cybersecurity and Infrastructure Security Agency keeps a public list called the Known Exploited Vulnerabilities catalog. A flaw is added when it has a CVE number, there is reliable proof attackers are using it, and a clear fix exists. CISA strongly recommends that all organizations, not only government offices, review this list and fix those items first. A simple habit helps: look at the list each week and compare it with your inventory.
Step 5: Handle what cannot be patched
Sometimes there is no patch yet, or the device is too old to take one. NIST describes two plans for this. Emergency mitigation is a temporary step, such as turning off a feature, that lowers the risk until a patch arrives. For assets that cannot be patched at all, the guide says to plan other protections, such as isolating the device or replacing it.
Write down every exception, who approved it and when it will be reviewed. An exception with no review date tends to last for years.
Finally, check your work. After each cycle, confirm the updates installed. NIST lists verification as part of the job, and it is the step most often missed.