Patch Compliance Dashboard
Reports patch coverage and latency by severity, ring and asset class against the standard.
Available soon
- Format
- Excel
- Size
- 84 KB
- Length
- 12 sheets
- Version
- 1.0
- Updated
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Dashboard: enter the report month (its last day) and the as-at date. Type both; never a formula that changes them. |
| 2 | Deployments: one row per ring or server group per release, from the Patch Deployment Verification Checklist. Enter the dates, the assets, how many are installed and verified at the month end, the day 95% of a ring (or all of a group) was verified, and the findings each closed by P01 priority: one per system per release. Deadlines, latency and results calculate. |
| 3 | Coverage: enter the assets in scope in each asset class from the asset inventory. Assets still missing a patch calculate from Deployments. Where one asset is missing patches from two deployments, enter it once in 'Counted twice'. |
| 4 | End of Life: copy each row of the End-of-Life Software & Unsupported System Register (end of support, extended support, the exception's expiry and the retirement date). PCM-04 counts systems past support with neither an unexpired exception nor a retirement date. |
| 5 | Deferrals: copy each patch deferral from the P02 exception register, with its expiry and the date it was closed. PCM-05 counts those past their expiry and still open. |
| 6 | On the Dashboard, check each measure's target and tolerance limit (yellow), read the status, and write the commentary for any measure not on target or worse than last month. A measure outside tolerance goes to the next executive committee with its plan (PM-19). |
| 7 | After the meeting, copy the month's five figures into 'Month by month' at the foot of the Dashboard as values, so next month shows the direction. Keep each month's copy of the workbook as the record. |
| 8 | To clear the EXAMPLE, delete the contents of the 'Row' column and of every yellow cell on Deployments, End of Life and Deferrals, the in-scope counts on Coverage, and the month-by-month record. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Rule PM-19: "The headline measures must be reported monthly to the security and IT leadership team, and any measure outside tolerance to the next executive committee with its plan. Any other departure from this standard is a P02 exception, and a Critical exception is approved by the board or its equivalent."
Status words: On target; Below target, within tolerance; Outside tolerance; No target set. The colour only repeats the words. PCM-03 and PCM-05 are the vulnerability management pack's deadline adherence and the exception pack's expired exceptions, unchanged (P11 MC-03 and MC-06), counted here for the findings patching closed and for patch deferrals.
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its September 2026 dashboard, the first cycle under the standard, as at 30 Sep 2026. September's cycle reached 97% of devices, servers and appliances, and 7 of 9 deployments met their deadline. The exploited ordering platform flaw was mitigated within 4 hours and patched three days later. The two late deployments were the warehouse system, deferred under an approved exception, and the ordering platform's search component, a week late while that team is short of staff. There is no August figure, so each direction reads "No previous value".
Tailoring — small organisation: PCM-01, PCM-02 and PCM-04 are the minimum. Keep latency against each deadline, never an average alone.
Tailoring — IT run by a managed service provider: the provider's monthly report is an input, never the dashboard. Take its figures from its management tool and the scan, and check a sample against the scanner yourself.
Tailoring — regulated financial entity: the monthly dashboard is the record that remediation is monitored and verified (Delegated Regulation (EU) 2024/1774, Article 10(2)(g)). Keep each month's copy.
Dashboard
Patch compliance: monthly dashboard
For the security and it leadership team (PM-19). Yellow cells are yours; everything else calculates from Deployments, Coverage, End of Life and Deferrals. Every status is in words; the colour only repeats it.
Report settings
| Setting | Value | |
|---|---|---|
| Month (its last day) | 30 Sep 2026 | EXAMPLE: the first month under the standard. |
| As-at date (the day you read it) | 30 Sep 2026 | |
| Period start (calc) | 1 Sep 2026 |
Headline measures (PM-19)
| Measure | Result | Figure judged | Target | Target used | Tolerance limit | Status | Last month | Direction | Escalation | Owner's commentary |
|---|---|---|---|---|---|---|---|---|---|---|
| PCM-01 Patch coverage | 639 of 657 assets | 97% | [[95%]] | 95% | 90% | On target | No previous value | 18 laptops still missing September's update: staff on leave and spare devices in stores. Each is chased by name before the 9 Oct 2026 deadline. | ||
| PCM-02 Patch latency | 7 of 9 deployments | 78% | Every deployment within its P01 deadline | 100% | 75% | Below target, within tolerance | No previous value | Two late. The warehouse management system (DEP-06) waited for its supplier's certification and was deferred under DEF-2026-01 before its deadline. The ordering platform's search component (DEP-08) was 7 days late with no deferral: the team is two engineers short (P05 TA-03). Supplier certification is on the agenda of the supplier's assessment on 20 Oct 2026. | ||
| PCM-03 Deadline adherence | 635 of 639 findings | 99% | [[90%]] | 90% | 85% | On target | No previous value | Priority 1 and 2: 8 of 12 within deadline; the four late findings are the two above. The exploited ordering platform flaw was mitigated in hours and patched in days. | ||
| PCM-04 Systems past vendor support | 0 without; 1 past support | 0 | [[None without an unexpired exception and a retirement date]] | 0 | 0 | On target | No previous value | One storage appliance past support, isolated under a P02 exception until it is retired on 30 Nov 2026. | ||
| PCM-05 Expired exceptions | 0 of 1 open deferrals | 0% | Zero High or Critical; below 5% overall | 5% | 5% | On target | No previous value | One patch deferral open, none expired. |
Status: On target; Below target, within tolerance; Outside tolerance; No target set. Shares are figures from 0 to 1, shown as percentages. PCM-04 is a count: lower is better.
PCM-01 Patch coverage by asset class
| Asset class | In scope | Every patch verified | Share | Status | Note | |||||
|---|---|---|---|---|---|---|---|---|---|---|
| AC-1 End-user devices | 640 | 622 | 97% | On target | Laptops, desktops and tablets: their operating system, office software, browsers, document readers and other installed applications. | |||||
| AC-2 Servers | 11 | 11 | 100% | On target | Server operating systems, databases and server applications, on premises and in the organisation's own cloud subscriptions. | |||||
| AC-3 Network and security appliances | 6 | 6 | 100% | On target | Firewalls, remote access gateways, switches, wireless controllers and storage appliances. | |||||
| AC-4 Business applications | Counted with AC-2 | AC-4 is counted with the servers its components run on. | ||||||||
| AC-5 Cloud and software services the provider patches | Assured through the contract (PM-13) | AC-5 services are assured through their contracts (PM-13). | ||||||||
Each class is judged against PCM-01's target and tolerance limit above.
PCM-02 and PCM-03 by P01 priority
| Priority | Deadline (days) | Deployments | Within deadline | Longest latency (days) | Findings closed | Closed within deadline | Share |
|---|---|---|---|---|---|---|---|
| Priority 1 | 7 | 1 | 1 | 4 | 2 | 2 | 100% |
| Priority 2 | 14 | 5 | 3 | 22 | 10 | 6 | 60% |
| Priority 3 | 30 | 5 | 5 | 15 | 627 | 627 | 100% |
| Priority 4 | 90 | 0 | 0 | 0 | 0 | ||
| Priority 1 and 2 (as the board measure counts them, P03 BM-02) | 12 | 8 | 67% |
A deployment counts under every priority among its systems. Latency is from the vendor's release to the day 95% of a ring, or all of a group, was verified.
PCM-02 Patch latency by ring or group
| Deployment | Ring or group | Release | Highest priority | Latency (days) | Deadline | Result | Route |
|---|---|---|---|---|---|---|---|
| DEP-01 | RG-0 | REL-01 | Priority 3 | 2 | 9 Oct 2026 | Within deadline | RT-C |
| DEP-02 | RG-1 | REL-01 | Priority 3 | 7 | 9 Oct 2026 | Within deadline | RT-C |
| DEP-03 | RG-2 | REL-01 | Priority 3 | 15 | 9 Oct 2026 | Within deadline | RT-C |
| DEP-04 | SG-A | REL-01 | Priority 2 | 9 | 23 Sep 2026 | Within deadline | RT-C |
| DEP-05 | SG-B | REL-01 | Priority 2 | 13 | 23 Sep 2026 | Within deadline | RT-C |
| DEP-06 | SG-W | REL-01 | Priority 2 | 20 | 23 Sep 2026 | Late | RT-C |
| DEP-07 | NW-1 | REL-02 | Priority 2 | 15 | 17 Sep 2026 | Within deadline | RT-C |
| DEP-08 | Ordering platform | REL-03 | Priority 2 | 22 | 16 Sep 2026 | Late | RT-X |
| DEP-09 | Ordering platform | REL-04 | Priority 1 | 4 | 1 Oct 2026 | Within deadline | RT-E |
PCM-04 and PCM-05 in detail
| Count | Systems or deferrals |
|---|---|
| Past support: no security patches | 1 |
| of which with an unexpired exception and a retirement date | 1 |
| Past normal support: on extended support | 1 |
| Support ends within 12 months | 1 |
| Patch deferrals open, including expired | 1 |
| of which expired, High or Critical band | 0 |
Month by month (enter the figures as values after each meeting)
| Month end | PCM-01 | PCM-02 | PCM-03 | PCM-04 | PCM-05 |
|---|---|---|---|---|---|
| 30 Sep 2026 | 97% | 78% | 99% | 0 | 0% |
EXAMPLE: September 2026 is the first month under the standard, so there is no August row.
Deployments
One row per ring or server group per release, from the Patch Deployment Verification Checklist. Yellow columns are yours; white columns calculate. Findings: one per system per release, by its P01 priority.
| Row | Deployment ID | Release | Ring or group | Asset class | Route | Released | First detected | Assets | Installed and verified at the month end | 95% (ring) or all (group) verified on | Findings closed, Priority 1 | Findings closed, Priority 2 | Findings closed, Priority 3 | Findings closed, Priority 4 | Highest P01 priority | Coverage class (calc) | Deadline (calc) | Latency, days (calc) | Still missing (calc) | Deployed | Counted this month (calc) | Result (calc) | Closed within deadline, Priority 1 (calc) | Closed within deadline, Priority 2 (calc) | Closed within deadline, Priority 3 (calc) | Closed within deadline, Priority 4 (calc) | Order (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | DEP-01 | REL-01 | RG-0 | AC-1 | RT-C | 8 Sep 2026 | 9 Sep 2026 | 32 | 32 | 10 Sep 2026 | 0 | 0 | 32 | 0 | 3 | AC-1 | 9 Oct 2026 | 2 | 0 | 9 Sep 2026 | Yes | Within deadline | 0 | 0 | 32 | 0 | 1 |
| EXAMPLE | DEP-02 | REL-01 | RG-1 | AC-1 | RT-C | 8 Sep 2026 | 9 Sep 2026 | 160 | 159 | 15 Sep 2026 | 0 | 0 | 159 | 0 | 3 | AC-1 | 9 Oct 2026 | 7 | 1 | 14 Sep 2026 | Yes | Within deadline | 0 | 0 | 159 | 0 | 2 |
| EXAMPLE | DEP-03 | REL-01 | RG-2 | AC-1 | RT-C | 8 Sep 2026 | 9 Sep 2026 | 448 | 431 | 23 Sep 2026 | 0 | 0 | 431 | 0 | 3 | AC-1 | 9 Oct 2026 | 15 | 17 | 16 Sep 2026 | Yes | Within deadline | 0 | 0 | 431 | 0 | 3 |
| EXAMPLE | DEP-04 | REL-01 | SG-A | AC-2 | RT-C | 8 Sep 2026 | 9 Sep 2026 | 5 | 5 | 17 Sep 2026 | 0 | 2 | 3 | 0 | 2 | AC-2 | 23 Sep 2026 | 9 | 0 | 16 Sep 2026 | Yes | Within deadline | 0 | 2 | 3 | 0 | 4 |
| EXAMPLE | DEP-05 | REL-01 | SG-B | AC-2 | RT-C | 8 Sep 2026 | 9 Sep 2026 | 4 | 4 | 21 Sep 2026 | 0 | 2 | 2 | 0 | 2 | AC-2 | 23 Sep 2026 | 13 | 0 | 20 Sep 2026 | Yes | Within deadline | 0 | 2 | 2 | 0 | 5 |
| EXAMPLE | DEP-06 | REL-01 | SG-W | AC-2 | RT-C | 8 Sep 2026 | 9 Sep 2026 | 2 | 2 | 28 Sep 2026 | 0 | 2 | 0 | 0 | 2 | AC-2 | 23 Sep 2026 | 20 | 0 | 27 Sep 2026 | Yes | Late | 0 | 0 | 0 | 0 | 6 |
| EXAMPLE | DEP-07 | REL-02 | NW-1 | AC-3 | RT-C | 2 Sep 2026 | 3 Sep 2026 | 2 | 2 | 17 Sep 2026 | 0 | 2 | 0 | 0 | 2 | AC-3 | 17 Sep 2026 | 15 | 0 | 16 Sep 2026 | Yes | Within deadline | 0 | 2 | 0 | 0 | 7 |
| EXAMPLE | DEP-08 | REL-03 | Ordering platform | AC-4 | RT-X | 1 Sep 2026 | 2 Sep 2026 | 2 | 2 | 23 Sep 2026 | 0 | 2 | 0 | 0 | 2 | AC-2 | 16 Sep 2026 | 22 | 0 | 22 Sep 2026 | Yes | Late | 0 | 0 | 0 | 0 | 8 |
| EXAMPLE | DEP-09 | REL-04 | Ordering platform | AC-4 | RT-E | 24 Sep 2026 | 24 Sep 2026 | 2 | 2 | 28 Sep 2026 | 2 | 0 | 0 | 0 | 1 | AC-2 | 1 Oct 2026 | 4 | 0 | 27 Sep 2026 | Yes | Within deadline | 2 | 0 | 0 | 0 | 9 |
Coverage
Assets in scope by class (PCM-01). Enter the in-scope counts from the asset inventory; assets still missing a patch calculate from Deployments.
| Class | Asset class | Assets in scope | Missing a patch (calc) | Counted twice | Every patch verified (calc) | Note | When not counted (calc) |
|---|---|---|---|---|---|---|---|
| AC-1 | End-user devices | 640 | 18 | 0 | 622 | Laptops, desktops and tablets: their operating system, office software, browsers, document readers and other installed applications. | |
| AC-2 | Servers | 11 | 0 | 0 | 11 | Server operating systems, databases and server applications, on premises and in the organisation's own cloud subscriptions. | |
| AC-3 | Network and security appliances | 6 | 0 | 0 | 6 | Firewalls, remote access gateways, switches, wireless controllers and storage appliances. | |
| AC-4 | Business applications | AC-4 is counted with the servers its components run on. | Counted with AC-2 | ||||
| AC-5 | Cloud and software services the provider patches | AC-5 services are assured through their contracts (PM-13). | Assured through the contract (PM-13) |
End of Life
Each row of the End-of-Life Software & Unsupported System Register, copied at the month end. Status calculates at the As-at date, with a look-ahead of 12 months.
| Row | Register ID | System or product | End of vendor support | Extended support paid to | P02 exception | Exception expiry | Retirement date | Status (calc) | PCM-04 (calc) |
|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | EOL-01 | NAS-W3 | 30 Jun 2024 | EX-2026-024 | 30 Nov 2026 | 30 Nov 2026 | Past support: no security patches | Exception and retirement date | |
| EXAMPLE | EOL-02 | Weighbridge PC, Warehouse 1 | 14 Oct 2025 | 12 Oct 2027 | 29 Jan 2027 | Past normal support: on extended support | |||
| EXAMPLE | EOL-03 | FW-01 and FW-02 | 31 Mar 2027 | 26 Feb 2027 | Support ends within 12 months |
Deferrals
Each patch deferral, copied from the P02 exception register at the month end. A deferral past its expiry that is neither closed nor renewed is expired (PCM-05).
| Row | Deferral ID | P02 exception | Systems | Band | Approved | Expiry | Closed on | Days to expiry (calc) | Status (calc) |
|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | DEF-2026-01 | EX-2026-025 | WMS-APP-01, WMS-DB-01 | Low | 22 Sep 2026 | 29 Sep 2026 | 28 Sep 2026 | Closed | |
| EXAMPLE | DEF-2026-02 | EX-2026-024 | NAS-W3 | Medium | 16 Sep 2026 | 30 Nov 2026 | 61 | Open |
Lists
| AssetClassID | RouteID | PriorityLevel | PriorityDays | Band |
|---|---|---|---|---|
| AC-1 | RT-C | 1 | 7 | Low |
| AC-2 | RT-X | 2 | 14 | Medium |
| AC-3 | RT-E | 3 | 30 | High |
| AC-4 | 4 | 90 | Critical |
AC-5
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| PCM-01 Patch coverage | Assets in scope with every security patch deployed to their ring or server group installed and verified at the period end, out of all assets in scope, by asset class. Services a provider patches are left out and assured through the contract (PM-13). |
| PCM-02 Patch latency | For each deployment in the period, the calendar days from the vendor's release to the day [[95%]] of the ring or server group had the patch installed and verified, shown by P01 priority and by ring or group, each against its P01 deadline. The figure judged is the share of deployments that met their deadline. |
| PCM-03 Deadline adherence | Findings closed in the period within their deadline ÷ findings closed in the period. Reported for the findings that patching closed, with Priority 1 and 2 shown apart, as the board measure for critical exposure counts them (P03 BM-02). Imported unchanged from the P01 pack (P11 MC-03). |
| PCM-04 Systems past vendor support | Systems in use at the period end that are past the end of vendor support with no extended support, each shown with whether it has an unexpired P02 exception and a retirement date. The figure judged is how many have neither. |
| PCM-05 Expired exceptions | Exceptions past their expiry date that are neither closed nor renewed, as a share of all open exceptions. Reported for patch deferrals. Imported unchanged from the P02 pack (P11 MC-06). |
| Latency | Calendar days from a vendor's release to the day a ring or server group had the patch installed and verified. |
| Verified | Installed, the service checked by its owner, and a scan no longer finds the vulnerability (P01 VM-13). |
| Deadline | The P01 deadline of the deployment's highest priority, from first detection: Priority 1, 7 days; Priority 2, 14 days; Priority 3, 30 days; Priority 4, 90 days. This dashboard never sets a different one (PM-02). |
| Status: On target | At or better than the target used this month. |
| Status: Below target, within tolerance | Short of the target but inside the tolerance limit. The commentary gives the plan and date. |
| Status: Outside tolerance | Beyond the tolerance limit. It goes to the next executive committee with its plan (PM-19). |
| Status: No target set | No target entered. Every measure needs one before it is reported. |
| Direction | Better, Same or Worse than last month's figure on the month-by-month record, read with which way is better; "No previous value" when there is none. |
| Counted this month | A deployment verified in the report month, or, if not yet verified, one whose deadline falls in it. |
| Deferral | Installing a patch after its P01 deadline, approved in advance as a P02 exception (PM-14). Moving a patch to a later window that is still inside its deadline is not a deferral. |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| PM-nn, PCM-nn, MC-nn | Rules and measures of the Patch Management Standard; metrics of the metrics catalogue (P11). |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, September 2026. Delete before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 9.1 — Monitoring, measurement, analysis and evaluation | The dashboard as a whole: what is measured, when, against which target, and the results evaluated each month |
| ISO/IEC 27001:2022 | Annex A 8.8 — Management of technical vulnerabilities | PCM-01 to PCM-04: whether technical vulnerabilities are being fixed in time |
| NIST CSF 2.0 | GV.OV-03 — “Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed” | Status, direction and escalation: performance evaluated and reviewed each month |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(e) — “security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure” | The measures as a whole: how vulnerability handling through patching is performing each month |
| DORA — Regulation (EU) 2022/2554 | Article 9(4)(f) — “have appropriate and comprehensive documented policies for patches and updates” | Headline measures against the patch policy's deadlines (financial entities) |
| DORA — Delegated Regulation (EU) 2024/1774 | Article 10(2)(g) — the vulnerability management procedures shall “monitor and verify the remediation of vulnerabilities” | PCM-02 and PCM-03: the remediation of vulnerabilities monitored and verified each month (financial entities) |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.