Patch Deployment Ring & Maintenance Window Plan
Defines pilot and production rings, maintenance windows and rollback criteria per system group.
Available soon
- Format
- Excel
- Size
- 74 KB
- Length
- 12 sheets
- Version
- 1.0
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Calendar: enter the year and month of the cycle. The release day (the second Tuesday) and every step's date calculate from the Monthly Patch Cycle Operating Procedure's offsets. Change an offset only together with that procedure. |
| 2 | Rings: name who is in each ring and enter the number of devices. The pilot covers every hardware model and every business application in use (RG-0); the early ring is spread across sites and departments and never more than half of any one team (RG-1). The share and its check calculate. |
| 3 | Groups and Windows: set each window's day, counted from the release day, and its hours. The check says whether a patch installed in that window is verified inside a Priority 2 deadline (PM-07). Then list your server and appliance groups and the window each uses. |
| 4 | Systems: one row per server and appliance from the asset inventory (PM-01): its class, criticality, exposure, group, redundant partner, owner and patch owner. The window, the pair check (GR-2, GR-4), the internet-facing check (GR-5) and the Priority 2 check calculate. Fix every red check before the cycle starts. |
| 5 | Rollback: set the two thresholds, then agree the criteria for each ring and group with the pilot users and system owners before its first deployment (PM-08), and enter who agreed and when. |
| 6 | Review the plan at every cycle's preparation step (CY-01), and whenever a system is added, a pair is broken or a supplier changes its certification dates. Keep each version as the record. |
| 7 | To clear the EXAMPLE, delete the contents of the 'Row' column and of every yellow cell on Rings, Systems and Rollback, and replace the groups on Groups and Windows. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Rule PM-06: "End-user devices must be patched in three rings, pilot, early and broad, each starting only when the one before has passed its rollback criteria. Servers are patched by group, and the two members of a redundant server pair never in the same window. The two members of a high-availability appliance pair are patched in the same window, one at a time (GR-4)."
Rule PM-07: "Every server and appliance must have a maintenance window, agreed by its system owner, at least once a month, and timed so that a Priority 2 patch released on the release day can be installed and verified inside its deadline."
Rule PM-08: "Every ring and server group must have rollback criteria agreed before deployment. A rollback stops the next ring until the cause is known, and the patch is re-planned inside its deadline or deferred under PM-14."
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its plan for the first cycle under the standard, September 2026: 640 devices in three rings, 11 servers and 6 appliances in 5 groups. The warehouse management system (SG-W) has one database server and runs round the clock, so its only window is the Sunday change window, after its supplier has certified the patch.
Tailoring — small organisation: With fewer than [[50]] end-user devices, the three rings PM-06 requires may be two: the pilot (RG-0), observed for [[2]] working days and still covering every hardware model and business application in use, then every other device. This is the only tailoring exception to PM-06. Keep the forced restart, and every server still has a group and a window.
Tailoring — IT run by a managed service provider: give the provider this plan as the contract's schedule. Its tool runs the rings; you keep the windows agreed with your system owners, and ask for the management tool's report and the scan (PM-10).
Tailoring — regulated financial entity: DORA's technical standards ask for restart, rollback and recovery procedures (Delegated Regulation (EU) 2024/1774, Article 8(2)(c)(iii)) and for patches to be tested and deployed with deadlines (Article 10(4)). The Rollback sheet and the windows are that record.
Calendar
Calendar: this cycle and the next twelve release days
Yellow cells are yours; everything else calculates. Days are calendar days from the release day (the Monthly Patch Cycle Operating Procedure).
Settings
| Setting | Value | Notes | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Year of the cycle | 2026 | EXAMPLE: the first cycle under the standard. | |||||||
| Month of the cycle (1 to 12) | 9 | ||||||||
| Release day (calc): the second Tuesday | 8 Sep 2026 | The largest vendors' release day. Every date below counts from it. | |||||||
| Days from release to first detection (for planning) | 1 | The scanner usually finds a missing patch the day after release. The deadline still runs from the actual first detection (P01 VM-08). | |||||||
| Priority 2 deadline (calendar days) | 14 | P01's, unchanged (PM-02). Not yours to change here. | |||||||
| Working days from a window to verification | 1 | The rescan and the owner's check, after the window (PM-10). | |||||||
| A Priority 2 patch released on the release day is due (calc) | 23 Sep 2026 | Release day + first detection + the Priority 2 deadline. Every window must be verified by then (PM-07). | |||||||
This cycle, step by step
| Step ID | Days from release day | Date (calc) | Day (calc) | Step | What, and who | ||||
|---|---|---|---|---|---|---|---|---|---|
| CY-01 | -5 | 3 Sep 2026 | Thu | Prepare | Confirm the pilot list, book the windows with the system owners, ask suppliers who certify patches for their dates, and clear last month's stragglers. Who: IT Operations Manager. | ||||
| CY-02 | 0 | 8 Sep 2026 | Tue | Review the releases | Read each vendor's advisory, rate each fix with the P01 model (exploited? internet-facing? severity? criticality?), and route it: monthly cycle, expedited or emergency (PM-03). Who: IT Operations Manager, with the Head of Information Security. | ||||
| CY-03 | 1 | 9 Sep 2026 | Wed | Approve and start the pilot | Approve the month's pre-approved standard change, check the patches' integrity, and deploy to the pilot ring and the test servers (PM-04, PM-05). Who: Head of IT approves; IT operations deploy. | ||||
| CY-04 | 3 | 11 Sep 2026 | Fri | Pilot go or no-go | After [[2]] working days, check the rollback criteria with the pilot users; go, or roll back and re-plan (PM-08). Who: IT Operations Manager. | ||||
| CY-05 | 6 | 14 Sep 2026 | Mon | Early ring | Deploy to the early ring. Who: IT operations. | ||||
| CY-06 | 8 | 16 Sep 2026 | Wed | Broad ring and Window A | Release to the broad ring, with users able to postpone the restart until the forced restart date; patch server group A and its appliance pairs in Window A. Who: IT operations; system owners check their services. | ||||
| CY-07 | 12 | 20 Sep 2026 | Sun | Window B | Patch server group B, its appliances, and the systems with a Sunday change window whose supplier has certified the patch. Who: IT operations; suppliers where they must attend. | ||||
| CY-08 | 14 | 22 Sep 2026 | Tue | Forced restart | Devices still waiting for a restart are restarted (PM-09). Who: Device management. | ||||
| CY-09 | 15 | 23 Sep 2026 | Wed | Verify and chase | Confirm installation, restarts and service checks; ask for the targeted rescans (P01 VM-13); list every asset still missing a patch, reschedule it inside its deadline or request a deferral before the deadline passes (PM-10, PM-14). Who: IT Operations Manager. | ||||
| CY-10 | Monthly report | Report | The month's measures go to the security and IT leadership team in the monthly reporting cycle (PM-19, P11 RL-1). Who: IT Operations Manager. | ||||||
CY-06 and CY-07 take their days from Window A and Window B on the Groups and Windows sheet. The forced restart (CY-08) is PM-09's: users may postpone a restart until then, and no later.
The next twelve release days
| Month | Release day | Pilot starts (CY-03) | Early ring (CY-05) | Window A | Window B | Forced restart (CY-08) | Verify and chase (CY-09) | Priority 2 due |
|---|---|---|---|---|---|---|---|---|
| 1 Sep 2026 | 8 Sep 2026 | 9 Sep 2026 | 14 Sep 2026 | 16 Sep 2026 | 20 Sep 2026 | 22 Sep 2026 | 23 Sep 2026 | 23 Sep 2026 |
| 1 Oct 2026 | 13 Oct 2026 | 14 Oct 2026 | 19 Oct 2026 | 21 Oct 2026 | 25 Oct 2026 | 27 Oct 2026 | 28 Oct 2026 | 28 Oct 2026 |
| 1 Nov 2026 | 10 Nov 2026 | 11 Nov 2026 | 16 Nov 2026 | 18 Nov 2026 | 22 Nov 2026 | 24 Nov 2026 | 25 Nov 2026 | 25 Nov 2026 |
| 1 Dec 2026 | 8 Dec 2026 | 9 Dec 2026 | 14 Dec 2026 | 16 Dec 2026 | 20 Dec 2026 | 22 Dec 2026 | 23 Dec 2026 | 23 Dec 2026 |
| 1 Jan 2027 | 12 Jan 2027 | 13 Jan 2027 | 18 Jan 2027 | 20 Jan 2027 | 24 Jan 2027 | 26 Jan 2027 | 27 Jan 2027 | 27 Jan 2027 |
| 1 Feb 2027 | 9 Feb 2027 | 10 Feb 2027 | 15 Feb 2027 | 17 Feb 2027 | 21 Feb 2027 | 23 Feb 2027 | 24 Feb 2027 | 24 Feb 2027 |
| 1 Mar 2027 | 9 Mar 2027 | 10 Mar 2027 | 15 Mar 2027 | 17 Mar 2027 | 21 Mar 2027 | 23 Mar 2027 | 24 Mar 2027 | 24 Mar 2027 |
| 1 Apr 2027 | 13 Apr 2027 | 14 Apr 2027 | 19 Apr 2027 | 21 Apr 2027 | 25 Apr 2027 | 27 Apr 2027 | 28 Apr 2027 | 28 Apr 2027 |
| 1 May 2027 | 11 May 2027 | 12 May 2027 | 17 May 2027 | 19 May 2027 | 23 May 2027 | 25 May 2027 | 26 May 2027 | 26 May 2027 |
| 1 Jun 2027 | 8 Jun 2027 | 9 Jun 2027 | 14 Jun 2027 | 16 Jun 2027 | 20 Jun 2027 | 22 Jun 2027 | 23 Jun 2027 | 23 Jun 2027 |
| 1 Jul 2027 | 13 Jul 2027 | 14 Jul 2027 | 19 Jul 2027 | 21 Jul 2027 | 25 Jul 2027 | 27 Jul 2027 | 28 Jul 2027 | 28 Jul 2027 |
| 1 Aug 2027 | 10 Aug 2027 | 11 Aug 2027 | 16 Aug 2027 | 18 Aug 2027 | 22 Aug 2027 | 24 Aug 2027 | 25 Aug 2027 | 25 Aug 2027 |
Book these windows with the system owners a year ahead. A vendor that releases on another day, or out of turn, follows the same steps from its own release (PM-03).
Rings
The 3 rings for end-user devices (PM-06). Each starts only when the one before has passed its rollback criteria. Yellow columns are yours.
| Row | Ring ID | Ring | Who is in it | Starts when | Observed for | Cycle step | Starts this cycle (calc) | Target share | Devices | Share of devices (calc) | Check (calc) | Covers every hardware model and business application? (pilot) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | RG-0 | Pilot | The IT team's own devices, test servers, and [[2]] pilot users from each department and site: about [[5]]% of devices, covering every hardware model and every business application in use | The day after the release review | [[2]] working days | CY-03 | 9 Sep 2026 | 5% | 32 | 5% | About the target | Yes |
| EXAMPLE | RG-1 | Early | About [[25]]% of devices, spread across every site and department, and never more than half of any one team | When the pilot has passed its rollback criteria | [[2]] working days | CY-05 | 14 Sep 2026 | 25% | 160 | 25% | About the target | N/A |
| EXAMPLE | RG-2 | Broad | Every other device | When the early ring has passed its rollback criteria | Until the forced restart date | CY-06 | 16 Sep 2026 | 70% | 448 | 70% | About the target | N/A |
| Devices in the rings (calc) | 640 | ||||||
| A ring is about its target when its share is within this many percentage points of it | 2% |
A group of end-user devices that receives a patch at the same stage. Pilot first, then early, then broad, each starting only when the one before has passed its rollback criteria. The pilot is observed for [[2]] working days before the early ring starts (PM-05).
Groups and Windows
Maintenance windows and server groups
Each window is a day counted from the release day. Each group of servers or appliances uses one window (GR-1). Yellow cells are yours; the dates and checks calculate.
Maintenance windows
| Window | Name | When | Days from release day | Date this cycle (calc) | Verified by (calc) | Priority 2 check (calc) | Used for |
|---|---|---|---|---|---|---|---|
| MW-A | Window A | The Wednesday of the week after the release day, [[20:00 to 23:00]] | 8 | 16 Sep 2026 | 17 Sep 2026 | Inside a Priority 2 deadline | Server group A, and the appliance pairs whose group uses it (both members, one at a time, GR-4) |
| MW-B | Window B | The Sunday after Window A, [[02:00 to 06:00]] | 12 | 20 Sep 2026 | 21 Sep 2026 | Inside a Priority 2 deadline | Server group B, the appliances whose group uses it, and systems with a Sunday change window |
| MW-E | Emergency window | Any time the emergency change sets (PM-11) | Any time (PM-11) | Any time (PM-11) | Priority 1 patches, and expedited patches with no window inside their deadline |
Server and appliance groups
| Group | Window | What is in it | Systems (calc) | Date this cycle (calc) | Days from release (calc) | Pairs split wrongly (calc) |
|---|---|---|---|---|---|---|
| SG-A | MW-A | One domain controller, one file server and one ordering platform web server, with the servers whose loss nobody notices for a night | 5 | 16 Sep 2026 | 8 | 0 |
| SG-B | MW-B | The other member of each pair | 4 | 20 Sep 2026 | 12 | 0 |
| SG-W | MW-B | Warehouse management system: Sunday change window only, after the supplier has certified the patch, with the supplier's engineer attending the restart | 2 | 20 Sep 2026 | 12 | 0 |
| NW-1 | MW-A | Firewall pair, both in Window A, the earliest (GR-5): the standby firewall first, then the other once the standby is back in service (GR-4) | 2 | 16 Sep 2026 | 8 | 0 |
| NW-2 | MW-B | Core switches and the wireless controller: Sunday window, because the warehouses run round the clock; one warehouse at a time | 4 | 20 Sep 2026 | 12 | 0 |
Rules for groups and windows
| Rule | What it requires | ||||||
|---|---|---|---|---|---|---|---|
| GR-1 | Every server belongs to one group, and every group to one maintenance window. | ||||||
| GR-2 | The two members of a redundant server pair (domain controllers, clustered nodes, load-balanced web servers) are in different groups with different windows, so one is always running and a faulty patch reaches only one. | ||||||
| GR-3 | The first server group is patched only after the pilot ring and the test servers have passed their rollback criteria. | ||||||
| GR-4 | The two members of a high-availability appliance pair (firewalls, remote access gateways) are in the same group and patched in the same window, one at a time: the standby first, the other only after the first is back in service and has passed its service check. A pair never runs two firmware versions for longer than the window. | ||||||
| GR-5 | Internet-facing systems are in the earliest group their redundancy allows, because their deadlines are the shortest (P01). | ||||||
| GR-6 | A system whose supplier must certify each patch has its own group, whose window falls after the certification date the contract sets. | ||||||
Systems
One row per server and appliance (PM-01). End-user devices are in the Rings. Yellow columns are yours; the checks calculate.
| Row | System | Role | Asset class | Criticality | Exposure | Group | Window (calc) | Days from release (calc) | Redundant partner | Partner's group (calc) | Pair check (calc) | Internet-facing check (calc) | Priority 2 check (calc) | Supplier certifies each patch? | System owner | Patch owner |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | DC-01 | Domain controller | AC-2 | Critical | Internal | SG-A | MW-A | 8 | DC-02 | SG-B | Different groups (GR-2) | Inside a Priority 2 deadline | No | Head of IT | IT Operations Manager | |
| EXAMPLE | FS-01 | File server | AC-2 | High | Internal | SG-A | MW-A | 8 | FS-02 | SG-B | Different groups (GR-2) | Inside a Priority 2 deadline | No | Head of IT | IT Operations Manager | |
| EXAMPLE | APP-01 | Application server (label printing) | AC-2 | Standard | Internal | SG-A | MW-A | 8 | No redundant pair | Inside a Priority 2 deadline | No | Head of IT | IT Operations Manager | |||
| EXAMPLE | PRN-01 | Print server | AC-2 | Standard | Internal | SG-A | MW-A | 8 | No redundant pair | Inside a Priority 2 deadline | No | Head of IT | IT Operations Manager | |||
| EXAMPLE | WEB-01 | Ordering platform web server (hosted, P06 SUP-002) | AC-2 | Critical | Internet-facing | SG-A | MW-A | 8 | WEB-02 | SG-B | Different groups (GR-2) | Earliest window its redundancy allows (GR-5) | Inside a Priority 2 deadline | No | Chief Operating Officer | IT Operations Manager (operating system); the ordering platform team (application) |
| EXAMPLE | DC-02 | Domain controller | AC-2 | Critical | Internal | SG-B | MW-B | 12 | DC-01 | SG-A | Different groups (GR-2) | Inside a Priority 2 deadline | No | Head of IT | IT Operations Manager | |
| EXAMPLE | FS-02 | File server | AC-2 | High | Internal | SG-B | MW-B | 12 | FS-01 | SG-A | Different groups (GR-2) | Inside a Priority 2 deadline | No | Head of IT | IT Operations Manager | |
| EXAMPLE | APP-02 | Application server (intranet and reports) | AC-2 | Standard | Internal | SG-B | MW-B | 12 | No redundant pair | Inside a Priority 2 deadline | No | Head of IT | IT Operations Manager | |||
| EXAMPLE | WEB-02 | Ordering platform web server (hosted, P06 SUP-002) | AC-2 | Critical | Internet-facing | SG-B | MW-B | 12 | WEB-01 | SG-A | Different groups (GR-2) | Earliest window its redundancy allows (GR-5) | Inside a Priority 2 deadline | No | Chief Operating Officer | IT Operations Manager (operating system); the ordering platform team (application) |
| EXAMPLE | WMS-APP-01 | Warehouse management system application server | AC-2 | Critical | Internal | SG-W | MW-B | 12 | No redundant pair | Inside a Priority 2 deadline | Yes | Head of Logistics | IT Operations Manager, with the supplier (P06 SUP-010) | |||
| EXAMPLE | WMS-DB-01 | Warehouse management system database server | AC-2 | Critical | Internal | SG-W | MW-B | 12 | No redundant pair | Inside a Priority 2 deadline | Yes | Head of Logistics | IT Operations Manager, with the supplier (P06 SUP-010) | |||
| EXAMPLE | FW-01 | Firewall (internet edge) | AC-3 | Critical | Internet-facing | NW-1 | MW-A | 8 | FW-02 | NW-1 | One at a time in the window (GR-4) | Earliest window its redundancy allows (GR-5) | Inside a Priority 2 deadline | No | Head of IT | IT Operations Manager |
| EXAMPLE | FW-02 | Firewall (internet edge) | AC-3 | Critical | Internet-facing | NW-1 | MW-A | 8 | FW-01 | NW-1 | One at a time in the window (GR-4) | Earliest window its redundancy allows (GR-5) | Inside a Priority 2 deadline | No | Head of IT | IT Operations Manager |
| EXAMPLE | SW-W1 | Core switch, Warehouse 1 | AC-3 | High | Internal | NW-2 | MW-B | 12 | No redundant pair | Inside a Priority 2 deadline | No | Head of IT | IT Operations Manager | |||
| EXAMPLE | SW-W2 | Core switch, Warehouse 2 | AC-3 | High | Internal | NW-2 | MW-B | 12 | No redundant pair | Inside a Priority 2 deadline | No | Head of IT | IT Operations Manager | |||
| EXAMPLE | SW-W3 | Core switch, Warehouse 3 | AC-3 | High | Internal | NW-2 | MW-B | 12 | No redundant pair | Inside a Priority 2 deadline | No | Head of IT | IT Operations Manager | |||
| EXAMPLE | WLC-01 | Wireless controller | AC-3 | High | Internal | NW-2 | MW-B | 12 | No redundant pair | Inside a Priority 2 deadline | No | Head of IT | IT Operations Manager |
Rollback
Rollback criteria, and who agreed them
What stops a ring or a window and starts a rollback (PM-08). Agree the criteria for every ring and group before its first deployment; a rollback stops the next ring or group until the cause is known.
Thresholds
| Threshold | Value | ||
|---|---|---|---|
| A ring stops when more than this share of its devices fail to install after two attempts (RB-3) | 2% | ||
| A server's service check, this many minutes after the restart (RB-4, VF-03) | 30 | ||
Rollback criteria
| Criterion | What stops the ring or window | Applies to | |||
|---|---|---|---|---|---|
| RB-1 | Any pilot device fails to start, loses its network connection or cannot sign in after the patch. | RG-0 | |||
| RB-2 | A business application on the pilot test list fails to start or to do its main task. | RG-0 | |||
| RB-3 | More than [[2]]% of a ring's devices fail to install the patch after two attempts. | RG-0, RG-1, RG-2 | |||
| RB-4 | A server's service check fails [[30]] minutes after the restart and cannot be fixed inside the window. | SG-A, SG-B, SG-W, NW-1, NW-2 | |||
| RB-5 | The vendor withdraws or replaces the patch, or publishes a known issue that affects a system or application in use. | RG-0, RG-1, RG-2, SG-A, SG-B, SG-W, NW-1, NW-2 | |||
When a criterion is met
| Step | What to do | ||||
|---|---|---|---|---|---|
| 1 | Stop the next ring or group at once; nothing further is deployed until the cause is known. | ||||
| 2 | Roll back the affected systems inside the window: uninstall the patch, or restore the snapshot or backup taken before it. | ||||
| 3 | Tell the Head of Information Security the same day, because the vulnerability is open again. | ||||
| 4 | Re-plan the patch inside its P01 deadline, with the vendor's fix or workaround; if that cannot be done, request a deferral before the deadline passes (PM-14). | ||||
Criteria agreed for each ring and group
| Ring or group | Criteria that apply | Agreed by | Agreed on | First deployment this cycle (calc) | Check (calc) |
|---|---|---|---|---|---|
| RG-0 | RB-1, RB-2, RB-3, RB-5 | IT Operations Manager, with the pilot users | 3 Sep 2026 | 9 Sep 2026 | Agreed before deployment (PM-08) |
| RG-1 | RB-3, RB-5 | IT Operations Manager, with the pilot users | 3 Sep 2026 | 14 Sep 2026 | Agreed before deployment (PM-08) |
| RG-2 | RB-3, RB-5 | IT Operations Manager, with the pilot users | 3 Sep 2026 | 16 Sep 2026 | Agreed before deployment (PM-08) |
| SG-A | RB-4, RB-5 | IT Operations Manager, with the system owners | 3 Sep 2026 | 16 Sep 2026 | Agreed before deployment (PM-08) |
| SG-B | RB-4, RB-5 | IT Operations Manager, with the system owners | 3 Sep 2026 | 20 Sep 2026 | Agreed before deployment (PM-08) |
| SG-W | RB-4, RB-5 | IT Operations Manager, with the system owners | 3 Sep 2026 | 20 Sep 2026 | Agreed before deployment (PM-08) |
| NW-1 | RB-4, RB-5 | IT Operations Manager, with the system owners | 3 Sep 2026 | 16 Sep 2026 | Agreed before deployment (PM-08) |
| NW-2 | RB-4, RB-5 | IT Operations Manager, with the system owners | 3 Sep 2026 | 20 Sep 2026 | Agreed before deployment (PM-08) |
Lists
| AssetClassID | AssetClass | Criticality | Exposure | YesNo | YesNoNA |
|---|---|---|---|---|---|
| AC-1 | End-user devices | Critical | Internet-facing | Yes | Yes |
| AC-2 | Servers | High | Internal | No | No |
| AC-3 | Network and security appliances | Standard | N/A | ||
| AC-4 | Business applications | ||||
| AC-5 | Cloud and software services the provider patches |
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Ring | A group of end-user devices that receives a patch at the same stage. Pilot first, then early, then broad, each starting only when the one before has passed its rollback criteria. |
| Server group | A group of servers or appliances patched in the same maintenance window. The two members of a redundant server pair are always in different groups; the two members of a high-availability appliance pair are in the same group and patched one at a time. |
| Maintenance window | An agreed, recurring time when a system may be patched and restarted, approved by its system owner. |
| Release day | The day a vendor publishes its regular patches. For the largest operating system and office software vendors it is the second Tuesday of the month; other vendors release monthly, quarterly or whenever a fix is ready. |
| Rollback | Removing a patch, or restoring the system to its state before the patch, because the patch broke something. |
| Monthly cycle | The routine that takes each month's releases from review through testing, deployment in rings and windows, and verification, on fixed days counted from the release day. |
| Days from release day | Calendar days counted from the vendor's release day, which is day 0. The dates on the Calendar add them to this month's release day. |
| Priority 2 check | Whether a patch installed in this window is verified inside a Priority 2 deadline: the window's day plus the days to verification, no later than the day of first detection plus 14 days (PM-07). Priority 1 patches never wait for a window: they take the emergency route (PM-11). |
| Pair check | Two servers that back each other up (domain controllers, clustered or load-balanced nodes) must be in different groups, so one is always running (GR-2). The two members of an appliance pair are patched one at a time in the same window (GR-4). |
| Internet-facing check | An internet-facing system goes in the earliest window its redundancy allows, because its deadlines are the shortest (GR-5). The second member of a pair passes when its partner is in the earliest window. |
| Internet-facing | Reachable from the internet, as the vulnerability management standard (P01) defines it. |
| AC-1 End-user devices | Laptops, desktops and tablets: their operating system, office software, browsers, document readers and other installed applications. Delivered: Three rings (RG-0 to RG-2), automatically through device management; the restart forced on the cycle's restart date. |
| AC-2 Servers | Server operating systems, databases and server applications, on premises and in the organisation's own cloud subscriptions. Delivered: By server group in its maintenance window; one member of a redundant pair at a time. |
| AC-3 Network and security appliances | Firewalls, remote access gateways, switches, wireless controllers and storage appliances. Delivered: Firmware one high-availability member at a time in the window; internet-facing devices first. |
| AC-4 Business applications | Line-of-business applications, web applications and the components and libraries they are built on. Delivered: In the application's own window, after the supplier has certified any operating system patch it depends on. |
| AC-5 Cloud and software services the provider patches | Software as a service, and hosting where the provider patches the platform beneath what the organisation runs. Delivered: The provider's own process; the organisation checks the provider's notices every month and patches its clients, agents and connectors. |
| Forced restart | The date, [[14]] days after the release day, when device management restarts every device still waiting for one (PM-09). |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| PM-nn, GR-n, RB-n, MW-x, CY-nn | Rules, group rules, rollback criteria, windows and cycle steps of the Patch Management Standard and the Monthly Patch Cycle Operating Procedure. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, September 2026. Delete before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 8.8 — Management of technical vulnerabilities | The plan as a whole: technical vulnerabilities fixed through planned, tested deployment |
| ISO/IEC 27001:2022 | Annex A 8.32 — Change management | Windows, rings and rollback criteria: patches deployed as controlled changes |
| NIST CSF 2.0 | PR.PS-02 — “Software is maintained, replaced, and removed commensurate with risk” | Rings and windows: software kept maintained on a fixed timetable |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Who the Implementing Regulation binds: the digital providers its Article 1 names. For others it shows what a regulator expects |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 6.6.1 — “The relevant entities shall specify and apply procedures, coherent with the change management procedures referred to in point 6.4.1 as well as with vulnerability management, risk management and other relevant management procedures, for ensuring that: (a) security patches are applied within a reasonable time after they become available; (b) security patches are tested before being applied in production systems; (c) security patches come from trusted sources and are checked for integrity; (d) additional measures are implemented and residual risks are accepted in cases where a patch is not available or not applied pursuant to point 6.6.2.” | Rings and the pilot: patches tested before production; windows timed so patches are applied within a reasonable time |
| DORA — Regulation (EU) 2022/2554 | Article 9(4)(e) — “implement documented policies, procedures and controls for ICT change management, including changes to software, hardware, firmware components, systems or security parameters, that are based on a risk assessment approach and are an integral part of the financial entity’s overall change management process, in order to ensure that all changes to ICT systems are recorded, tested, assessed, approved, implemented and verified in a controlled manner” | Windows booked as pre-approved changes, with rollback criteria agreed before each deployment (financial entities) |
| DORA — Delegated Regulation (EU) 2024/1774 | Article 8(2)(c)(iii) — “ICT system restart, rollback, and recovery procedures for use in the event of ICT system disruption” | Rollback sheet: restart and rollback steps agreed for each ring and group (financial entities) |
| DORA — Delegated Regulation (EU) 2024/1774 | Article 10(4) — the patch management procedures shall “(a) to the extent possible identify and evaluate available software and hardware patches and updates using automated tools; (b) identify emergency procedures for the patching and updating of ICT assets; (c) test and deploy the software and hardware patches and the updates referred to in Article 8(2), points (b)(v), (vi) and (vii); (d) set deadlines for the installation of software and hardware patches and updates and escalation procedures in case those deadlines cannot be met.” | Calendar: patches tested and deployed on fixed dates, inside the deadlines the standard sets (financial entities) |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.