Patch Deployment Verification Checklist
Confirms patches installed, services restored and exceptions recorded after each deployment.
Available soon
- Format
- Excel
- Size
- 94 KB
- Length
- 12 sheets
- Version
- 1.0
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Set the As-at date on the Summary: the day you verify, usually the cycle's verify-and-chase step (CY-09). Type it; never use a formula that changes it. |
| 2 | Deployments: one row per ring or server group per release. Enter the release, when it was released and first detected, the ring or group, its asset class, the route (monthly cycle, expedited or emergency) and the highest P01 priority among its systems. The deadline calculates from first detection (P01 VM-08); this checklist never sets a different one (PM-02). |
| 3 | Enter how many assets the ring or group holds, how many have the patch installed and verified at the As-at date, and the day 95% of a ring (or every system of a group) was verified. Latency, the deadline result and the stragglers calculate. Where the deployment was deferred before its deadline, enter the deferral's reference from the Patch Deferral Request Form. |
| 4 | Checks: for each deployment, record the five checks VF-01 to VF-05: the evidence, who checked, the date, and Pass, Fail or N/A. A Fail or N/A needs a reason. The How to Check sheet says what a pass looks like and what evidence to keep. A deployment is Verified only when VF-01 to VF-04 pass. |
| 5 | Stragglers: list every asset still missing the patch, with the reason and an install-by date inside its deadline (VF-05). If it cannot be installed in time, request a deferral before the deadline passes (PM-14) and enter its reference. |
| 6 | Read the Summary, put every Fail on the cycle's action list, and complete the sign-off. The figures feed the Patch Compliance Dashboard: patch latency (PCM-02) and deadline adherence (PCM-03). |
| 7 | To clear the EXAMPLE, delete the contents of the 'Row' column and of every yellow cell on Deployments, Checks and Stragglers. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Rule PM-10: "A deployment is complete only when the patch is confirmed installed, the system has restarted, its owner has checked the service, and a scan confirms the vulnerability is gone (P01 VM-13). Every asset still missing the patch is listed and rescheduled inside its deadline, or deferred."
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its first cycle under the standard, September 2026, verified as at 30 Sep 2026: 9 deployments, 7 within their deadline. The warehouse management system was late under an approved deferral (DEF-2026-01); the ordering platform's search component was late with no deferral, so its gap check fails. 18 laptops are still to be chased before their deadline.
Tailoring — small organisation: one row per release for all devices, and one per server window, is enough. Keep every check; a scan is still the proof (P01 VM-13).
Tailoring — IT run by a managed service provider: the provider fills in VF-01 and VF-02 from its management tool and attaches the report. The system owner's check (VF-03) and the rescan (VF-04) are yours to see, never the provider's word alone.
Tailoring — regulated financial entity: keep the checklist with the change record. DORA's technical standards expect the remediation of vulnerabilities to be monitored and verified (Delegated Regulation (EU) 2024/1774, Article 10(2)(g)).
Summary
Summary and sign-off
The month's deployments, their deadlines and checks, counted at the As-at date. Everything except the As-at date and the sign-off calculates from Deployments, Checks and Stragglers.
| As-at date | 30 Sep 2026 | EXAMPLE: the end of the first cycle's month. Use the day you verify. |
Deployments
| Result | Deployments | |
|---|---|---|
| Deployments recorded | 9 | |
| Within deadline | 7 | of 9 (PCM-02) |
| Late, under an approved deferral | 1 | |
| Late, no deferral (P01 VM-19) | 1 | |
| Overdue: not yet verified | 0 | |
| Not yet due | 0 | |
| Verified | 8 | |
| Verified; gaps not handled | 1 | |
| Not verified | 0 | |
| Not checked | 0 |
Assets still missing the patch
| Count | Assets |
|---|---|
| Missing at the As-at date (from Deployments) | 18 |
| Listed on Stragglers | 18 |
| Listed with an install-by date inside the deadline | 18 |
| Deferred | 0 |
| Still to reschedule or defer | 0 |
Checks
| Check | Pass | Fail | N/A | Not assessed |
|---|---|---|---|---|
| VF-01 Installed | 9 | 0 | 0 | 0 |
| VF-02 Restarted | 9 | 0 | 0 | 0 |
| VF-03 Service restored | 9 | 0 | 0 | 0 |
| VF-04 Scanner confirms | 9 | 0 | 0 | 0 |
| VF-05 Gaps handled | 8 | 1 | 0 | 0 |
| All checks | 44 | 1 | 0 | 0 |
Every Fail and N/A has its reason.
Sign-off
| Role | Name | Date | Signature or approval reference | ||
|---|---|---|---|---|---|
| Verified by | [[Name]] | [[YYYY-MM-DD]] | [[Reference]] | ||
| Reviewed by (Head of IT) | [[Name]] | [[YYYY-MM-DD]] | [[Reference]] | ||
| Seen by (Head of Information Security), for the month's report | [[Name]] | [[YYYY-MM-DD]] | [[Reference]] | ||
Deployments
One row per ring or server group per release. Yellow columns are yours; the deadline, latency and results calculate. The deadline is P01's, from first detection (PM-02).
| Row | Deployment ID | Release | What was deployed | Released | First detected | Ring or group | Asset class | Route | Highest P01 priority | Deployed | Assets in the ring or group | Installed and verified at the As-at date | 95% (ring) or all (group) verified on | Deferral reference | Deadline (calc) | Latency, days (calc) | Share verified (calc) | Still missing (calc) | Deadline result (calc) | Verification (calc) | Listed on Stragglers (calc) | Straggler check (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | DEP-01 | REL-01 | Monthly operating system and office software updates, with the month's browser and document reader updates | 8 Sep 2026 | 9 Sep 2026 | RG-0 | AC-1 | RT-C | 3 | 9 Sep 2026 | 32 | 32 | 10 Sep 2026 | 9 Oct 2026 | 2 | 100% | 0 | Within deadline | Verified | 0 | None missing | |
| EXAMPLE | DEP-02 | REL-01 | Monthly operating system and office software updates, with the month's browser and document reader updates | 8 Sep 2026 | 9 Sep 2026 | RG-1 | AC-1 | RT-C | 3 | 14 Sep 2026 | 160 | 159 | 15 Sep 2026 | 9 Oct 2026 | 7 | 99% | 1 | Within deadline | Verified | 1 | All listed (VF-05) | |
| EXAMPLE | DEP-03 | REL-01 | Monthly operating system and office software updates, with the month's browser and document reader updates | 8 Sep 2026 | 9 Sep 2026 | RG-2 | AC-1 | RT-C | 3 | 16 Sep 2026 | 448 | 431 | 23 Sep 2026 | 9 Oct 2026 | 15 | 96% | 17 | Within deadline | Verified | 17 | All listed (VF-05) | |
| EXAMPLE | DEP-04 | REL-01 | Monthly operating system and office software updates, with the month's browser and document reader updates | 8 Sep 2026 | 9 Sep 2026 | SG-A | AC-2 | RT-C | 2 | 16 Sep 2026 | 5 | 5 | 17 Sep 2026 | 23 Sep 2026 | 9 | 100% | 0 | Within deadline | Verified | 0 | None missing | |
| EXAMPLE | DEP-05 | REL-01 | Monthly operating system and office software updates, with the month's browser and document reader updates | 8 Sep 2026 | 9 Sep 2026 | SG-B | AC-2 | RT-C | 2 | 20 Sep 2026 | 4 | 4 | 21 Sep 2026 | 23 Sep 2026 | 13 | 100% | 0 | Within deadline | Verified | 0 | None missing | |
| EXAMPLE | DEP-06 | REL-01 | Monthly operating system and office software updates, with the month's browser and document reader updates | 8 Sep 2026 | 9 Sep 2026 | SG-W | AC-2 | RT-C | 2 | 27 Sep 2026 | 2 | 2 | 28 Sep 2026 | DEF-2026-01 | 23 Sep 2026 | 20 | 100% | 0 | Late, under an approved deferral | Verified | 0 | None missing |
| EXAMPLE | DEP-07 | REL-02 | Firewall firmware security fix | 2 Sep 2026 | 3 Sep 2026 | NW-1 | AC-3 | RT-C | 2 | 16 Sep 2026 | 2 | 2 | 17 Sep 2026 | 17 Sep 2026 | 15 | 100% | 0 | Within deadline | Verified | 0 | None missing | |
| EXAMPLE | DEP-08 | REL-03 | Security fix to the search component the ordering platform is built on | 1 Sep 2026 | 2 Sep 2026 | Ordering platform | AC-4 | RT-X | 2 | 22 Sep 2026 | 2 | 2 | 23 Sep 2026 | 16 Sep 2026 | 22 | 100% | 0 | Late, no deferral (P01 VM-19) | Verified; gaps not handled | 0 | None missing | |
| EXAMPLE | DEP-09 | REL-04 | Emergency security release of the ordering platform's web commerce software, for a remote code execution flaw the vendor reports is being exploited | 24 Sep 2026 | 24 Sep 2026 | Ordering platform | AC-4 | RT-E | 1 | 27 Sep 2026 | 2 | 2 | 28 Sep 2026 | 1 Oct 2026 | 4 | 100% | 0 | Within deadline | Verified | 0 | None missing |
Checks
The five checks for each deployment (PM-10). Choose the deployment and the check; the pass criterion and the evidence to keep appear. Yellow columns are yours.
| Row | Deployment ID | Check | Check name (calc) | Pass when (calc) | Evidence to keep (calc) | Evidence reference | Checked by | Date checked | Result | Reason (for Fail or N/A) | Needed for Verified (calc) | Check (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | DEP-01 | VF-01 | Installed | The management tool reports the patch, or the version or build number it sets, on every asset in the ring or group. | Management tool report, dated | Management tool report, 10 Sep 2026: 32 of 32 devices report the patch | IT Operations Manager | 10 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-01 | VF-02 | Restarted | No restart is pending, and the system has started since the patch was installed. | Restart status in the same report | No restart pending in the same report | IT Operations Manager | 10 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-01 | VF-03 | Service restored | The system owner, or the service's own health check, confirms the service starts and does its main task within [[30]] minutes of the restart. | Owner's confirmation or health check result on the change | Pilot users reported no fault; no rollback criterion met (RB-1 to RB-3) | IT Operations Manager | 10 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-01 | VF-04 | Scanner confirms | A targeted rescan no longer finds the vulnerability, and P01 closes the finding (VM-13). | Scan report, attached to the finding | Targeted rescan, 10 Sep 2026: finding closed (P01 VM-13) | IT Operations Manager | 10 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-01 | VF-05 | Gaps handled | Every asset still missing the patch is listed with the reason, and rescheduled inside its deadline or deferred before the deadline passes (PM-14). | Straggler list; deferral reference where one was needed | No asset missing the patch | IT Operations Manager | 10 Sep 2026 | Pass | No | OK | |
| EXAMPLE | DEP-02 | VF-01 | Installed | The management tool reports the patch, or the version or build number it sets, on every asset in the ring or group. | Management tool report, dated | Management tool report, 15 Sep 2026: 159 of 160 devices report the patch; the other 1 are on the straggler list | IT Operations Manager | 15 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-02 | VF-02 | Restarted | No restart is pending, and the system has started since the patch was installed. | Restart status in the same report | No restart pending in the same report | IT Operations Manager | 15 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-02 | VF-03 | Service restored | The system owner, or the service's own health check, confirms the service starts and does its main task within [[30]] minutes of the restart. | Owner's confirmation or health check result on the change | No rollback criterion met (RB-3); service desk calls at their normal level | IT Operations Manager | 15 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-02 | VF-04 | Scanner confirms | A targeted rescan no longer finds the vulnerability, and P01 closes the finding (VM-13). | Scan report, attached to the finding | Targeted rescan, 15 Sep 2026: finding closed (P01 VM-13) | IT Operations Manager | 15 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-02 | VF-05 | Gaps handled | Every asset still missing the patch is listed with the reason, and rescheduled inside its deadline or deferred before the deadline passes (PM-14). | Straggler list; deferral reference where one was needed | 1 on the straggler list, each to be installed by its 9 Oct 2026 deadline | IT Operations Manager | 15 Sep 2026 | Pass | No | OK | |
| EXAMPLE | DEP-03 | VF-01 | Installed | The management tool reports the patch, or the version or build number it sets, on every asset in the ring or group. | Management tool report, dated | Management tool report, 23 Sep 2026: 431 of 448 devices report the patch; the other 17 are on the straggler list | IT Operations Manager | 23 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-03 | VF-02 | Restarted | No restart is pending, and the system has started since the patch was installed. | Restart status in the same report | No restart pending on the devices with the patch; restart forced on 22 Sep 2026 (CY-08) | IT Operations Manager | 23 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-03 | VF-03 | Service restored | The system owner, or the service's own health check, confirms the service starts and does its main task within [[30]] minutes of the restart. | Owner's confirmation or health check result on the change | No rollback criterion met (RB-3); service desk calls at their normal level | IT Operations Manager | 23 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-03 | VF-04 | Scanner confirms | A targeted rescan no longer finds the vulnerability, and P01 closes the finding (VM-13). | Scan report, attached to the finding | Targeted rescan, 23 Sep 2026: finding closed (P01 VM-13) | IT Operations Manager | 23 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-03 | VF-05 | Gaps handled | Every asset still missing the patch is listed with the reason, and rescheduled inside its deadline or deferred before the deadline passes (PM-14). | Straggler list; deferral reference where one was needed | 17 on the straggler list, each to be installed by its 9 Oct 2026 deadline | IT Operations Manager | 23 Sep 2026 | Pass | No | OK | |
| EXAMPLE | DEP-04 | VF-01 | Installed | The management tool reports the patch, or the version or build number it sets, on every asset in the ring or group. | Management tool report, dated | Management tool report, 17 Sep 2026: 5 of 5 systems report the patch | IT Operations Manager | 17 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-04 | VF-02 | Restarted | No restart is pending, and the system has started since the patch was installed. | Restart status in the same report | No restart pending in the same report | IT Operations Manager | 17 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-04 | VF-03 | Service restored | The system owner, or the service's own health check, confirms the service starts and does its main task within [[30]] minutes of the restart. | Owner's confirmation or health check result on the change | System owners' checks recorded on the change within [[30]] minutes of each restart | IT Operations Manager | 17 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-04 | VF-04 | Scanner confirms | A targeted rescan no longer finds the vulnerability, and P01 closes the finding (VM-13). | Scan report, attached to the finding | Targeted rescan, 17 Sep 2026: finding closed (P01 VM-13) | IT Operations Manager | 17 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-04 | VF-05 | Gaps handled | Every asset still missing the patch is listed with the reason, and rescheduled inside its deadline or deferred before the deadline passes (PM-14). | Straggler list; deferral reference where one was needed | No asset missing the patch | IT Operations Manager | 17 Sep 2026 | Pass | No | OK | |
| EXAMPLE | DEP-05 | VF-01 | Installed | The management tool reports the patch, or the version or build number it sets, on every asset in the ring or group. | Management tool report, dated | Management tool report, 21 Sep 2026: 4 of 4 systems report the patch | IT Operations Manager | 21 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-05 | VF-02 | Restarted | No restart is pending, and the system has started since the patch was installed. | Restart status in the same report | No restart pending in the same report | IT Operations Manager | 21 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-05 | VF-03 | Service restored | The system owner, or the service's own health check, confirms the service starts and does its main task within [[30]] minutes of the restart. | Owner's confirmation or health check result on the change | System owners' checks recorded on the change within [[30]] minutes of each restart | IT Operations Manager | 21 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-05 | VF-04 | Scanner confirms | A targeted rescan no longer finds the vulnerability, and P01 closes the finding (VM-13). | Scan report, attached to the finding | Targeted rescan, 21 Sep 2026: finding closed (P01 VM-13) | IT Operations Manager | 21 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-05 | VF-05 | Gaps handled | Every asset still missing the patch is listed with the reason, and rescheduled inside its deadline or deferred before the deadline passes (PM-14). | Straggler list; deferral reference where one was needed | No asset missing the patch | IT Operations Manager | 21 Sep 2026 | Pass | No | OK | |
| EXAMPLE | DEP-06 | VF-01 | Installed | The management tool reports the patch, or the version or build number it sets, on every asset in the ring or group. | Management tool report, dated | Management tool report, 28 Sep 2026: 2 of 2 systems report the patch | IT Operations Manager | 28 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-06 | VF-02 | Restarted | No restart is pending, and the system has started since the patch was installed. | Restart status in the same report | No restart pending in the same report | IT Operations Manager | 28 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-06 | VF-03 | Service restored | The system owner, or the service's own health check, confirms the service starts and does its main task within [[30]] minutes of the restart. | Owner's confirmation or health check result on the change | Head of Logistics checked dispatch at all three warehouses, with the supplier's engineer present | IT Operations Manager | 28 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-06 | VF-04 | Scanner confirms | A targeted rescan no longer finds the vulnerability, and P01 closes the finding (VM-13). | Scan report, attached to the finding | Targeted rescan, 28 Sep 2026: finding closed (P01 VM-13) | IT Operations Manager | 28 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-06 | VF-05 | Gaps handled | Every asset still missing the patch is listed with the reason, and rescheduled inside its deadline or deferred before the deadline passes (PM-14). | Straggler list; deferral reference where one was needed | No asset missing at verification. Deferred before the 23 Sep 2026 deadline: DEF-2026-01 (P02 EX-2026-025), requested 21 Sep 2026, approved 22 Sep 2026 | IT Operations Manager | 28 Sep 2026 | Pass | No | OK | |
| EXAMPLE | DEP-07 | VF-01 | Installed | The management tool reports the patch, or the version or build number it sets, on every asset in the ring or group. | Management tool report, dated | Management tool report, 17 Sep 2026: 2 of 2 systems report the patch | IT Operations Manager | 17 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-07 | VF-02 | Restarted | No restart is pending, and the system has started since the patch was installed. | Restart status in the same report | No restart pending in the same report | IT Operations Manager | 17 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-07 | VF-03 | Service restored | The system owner, or the service's own health check, confirms the service starts and does its main task within [[30]] minutes of the restart. | Owner's confirmation or health check result on the change | Each firewall back in service before the other was patched; remote access and internet checks passed | IT Operations Manager | 17 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-07 | VF-04 | Scanner confirms | A targeted rescan no longer finds the vulnerability, and P01 closes the finding (VM-13). | Scan report, attached to the finding | Targeted rescan, 17 Sep 2026: finding closed (P01 VM-13) | IT Operations Manager | 17 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-07 | VF-05 | Gaps handled | Every asset still missing the patch is listed with the reason, and rescheduled inside its deadline or deferred before the deadline passes (PM-14). | Straggler list; deferral reference where one was needed | No asset missing the patch | IT Operations Manager | 17 Sep 2026 | Pass | No | OK | |
| EXAMPLE | DEP-08 | VF-01 | Installed | The management tool reports the patch, or the version or build number it sets, on every asset in the ring or group. | Management tool report, dated | Management tool report, 23 Sep 2026: 2 of 2 systems report the patch | IT Operations Manager | 23 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-08 | VF-02 | Restarted | No restart is pending, and the system has started since the patch was installed. | Restart status in the same report | No restart pending in the same report | IT Operations Manager | 23 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-08 | VF-03 | Service restored | The system owner, or the service's own health check, confirms the service starts and does its main task within [[30]] minutes of the restart. | Owner's confirmation or health check result on the change | The ordering platform team's check of product search, recorded on the change | IT Operations Manager | 23 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-08 | VF-04 | Scanner confirms | A targeted rescan no longer finds the vulnerability, and P01 closes the finding (VM-13). | Scan report, attached to the finding | Targeted rescan, 23 Sep 2026: finding closed (P01 VM-13) | IT Operations Manager | 23 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-08 | VF-05 | Gaps handled | Every asset still missing the patch is listed with the reason, and rescheduled inside its deadline or deferred before the deadline passes (PM-14). | Straggler list; deferral reference where one was needed | No asset missing at verification | IT Operations Manager | 23 Sep 2026 | Fail | Both web servers passed the 16 Sep 2026 deadline unpatched, with no deferral requested before it (PM-14). Reported overdue and escalated to the asset owner's manager the next day (P01 VM-19) | No | Put on the action list |
| EXAMPLE | DEP-09 | VF-01 | Installed | The management tool reports the patch, or the version or build number it sets, on every asset in the ring or group. | Management tool report, dated | Management tool report, 28 Sep 2026: 2 of 2 systems report the patch | IT Operations Manager | 28 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-09 | VF-02 | Restarted | No restart is pending, and the system has started since the patch was installed. | Restart status in the same report | Restarted 27 Sep 2026, 02:00 to 03:30, WEB-02, then WEB-01, behind the load balancer | IT Operations Manager | 28 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-09 | VF-03 | Service restored | The system owner, or the service's own health check, confirms the service starts and does its main task within [[30]] minutes of the restart. | Owner's confirmation or health check result on the change | The ordering platform team's duty engineer, 27 Sep 2026, 03:45 | IT Operations Manager | 28 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-09 | VF-04 | Scanner confirms | A targeted rescan no longer finds the vulnerability, and P01 closes the finding (VM-13). | Scan report, attached to the finding | Targeted rescan, 28 Sep 2026: finding closed (P01 VM-13) | IT Operations Manager | 28 Sep 2026 | Pass | Yes | OK | |
| EXAMPLE | DEP-09 | VF-05 | Gaps handled | Every asset still missing the patch is listed with the reason, and rescheduled inside its deadline or deferred before the deadline passes (PM-14). | Straggler list; deferral reference where one was needed | No asset missing the patch | IT Operations Manager | 28 Sep 2026 | Pass | No | OK |
Stragglers
Every asset still missing the patch at the As-at date, with why and when it will be installed (VF-05). Group assets with the same reason on one row; keep their names in the device management report.
| Row | Deployment ID | Assets | Which (name or asset tag) | Why it is missing | Install by | Deferral reference | Deadline (calc) | Result (calc) |
|---|---|---|---|---|---|---|---|---|
| EXAMPLE | DEP-02 | 1 | [[Laptop asset tag]] | Away on long-term leave; installs when it next connects | 9 Oct 2026 | 9 Oct 2026 | Install by is inside the deadline | |
| EXAMPLE | DEP-03 | 17 | [[Asset tags, listed by name in the device management report]] | Not connected since the restart was forced on 22 Sep 2026: staff on leave and spare devices in stores. Each is chased by name | 9 Oct 2026 | 9 Oct 2026 | Install by is inside the deadline |
How to Check
How to check a deployment
The five checks of PM-10, in order. A deployment is Verified when VF-01 to VF-04 pass; VF-05 shows whether every gap was handled in time.
| Check | What | Pass when | Evidence to keep |
|---|---|---|---|
| VF-01 | Installed | The management tool reports the patch, or the version or build number it sets, on every asset in the ring or group. | Management tool report, dated |
| VF-02 | Restarted | No restart is pending, and the system has started since the patch was installed. | Restart status in the same report |
| VF-03 | Service restored | The system owner, or the service's own health check, confirms the service starts and does its main task within [[30]] minutes of the restart. | Owner's confirmation or health check result on the change |
| VF-04 | Scanner confirms | A targeted rescan no longer finds the vulnerability, and P01 closes the finding (VM-13). | Scan report, attached to the finding |
| VF-05 | Gaps handled | Every asset still missing the patch is listed with the reason, and rescheduled inside its deadline or deferred before the deadline passes (PM-14). | Straggler list; deferral reference where one was needed |
Verify within [[1]] working day of each window or ring's deployment. Installed means: the patch is on the system and in effect: the management tool reports it, and any restart it needs has happened. A patch waiting for a restart is not installed.
If a check fails because the patch broke something: the rollback criteria of the Patch Deployment Ring & Maintenance Window Plan
| Criterion | What stops the next ring or group | ||
|---|---|---|---|
| RB-1 | Any pilot device fails to start, loses its network connection or cannot sign in after the patch. | ||
| RB-2 | A business application on the pilot test list fails to start or to do its main task. | ||
| RB-3 | More than [[2]]% of a ring's devices fail to install the patch after two attempts. | ||
| RB-4 | A server's service check fails [[30]] minutes after the restart and cannot be fixed inside the window. | ||
| RB-5 | The vendor withdraws or replaces the patch, or publishes a known issue that affects a system or application in use. |
Lists
| VFID | VFName | VFHow | VFEvidence | Result | PriorityLevel | PriorityDays | RouteID | AssetClassID |
|---|---|---|---|---|---|---|---|---|
| VF-01 | Installed | The management tool reports the patch, or the version or build number it sets, on every asset in the ring or group. | Management tool report, dated | Pass | 1 | 7 | RT-C | AC-1 |
| VF-02 | Restarted | No restart is pending, and the system has started since the patch was installed. | Restart status in the same report | Fail | 2 | 14 | RT-X | AC-2 |
| VF-03 | Service restored | The system owner, or the service's own health check, confirms the service starts and does its main task within [[30]] minutes of the restart. | Owner's confirmation or health check result on the change | N/A | 3 | 30 | RT-E | AC-3 |
| VF-04 | Scanner confirms | A targeted rescan no longer finds the vulnerability, and P01 closes the finding (VM-13). | Scan report, attached to the finding | 4 | 90 | AC-4 | ||
| VF-05 | Gaps handled | Every asset still missing the patch is listed with the reason, and rescheduled inside its deadline or deferred before the deadline passes (PM-14). | Straggler list; deferral reference where one was needed | AC-5 |
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Installed | The patch is on the system and in effect: the management tool reports it, and any restart it needs has happened. A patch waiting for a restart is not installed. |
| Verified | Installed, the service checked by its owner, and a scan no longer finds the vulnerability (P01 VM-13). |
| Deployment | One ring or server group receiving one release's patches. A release reaches several deployments: each ring, each server group, each appliance pair. |
| Deadline | The P01 deadline of the highest priority among the deployment's systems, counted in calendar days from first detection (P01 VM-08): Priority 1, 7 days; Priority 2, 14 days; Priority 3, 30 days; Priority 4, 90 days. Priority 1 also needs the mitigation within 72 hours (P01 VM-09). |
| Latency | Calendar days from a vendor's release to the day a ring or server group had the patch installed and verified. |
| 95% (ring) or all (group) | A ring counts as deployed on the day 95% of its devices were verified; a server or appliance group only when every system was. The rest of a ring are stragglers, listed and chased. |
| Straggler | An asset still missing the patch when the deployment is checked: a device that has not connected, an install that failed, a system that could not be restarted. |
| Deferral | Installing a patch after its P01 deadline, approved in advance as a P02 exception (PM-14). Moving a patch to a later window that is still inside its deadline is not a deferral. |
| Route | RT-C Monthly cycle: Priority 2 to 4 patches whose P01 deadline falls on or after the date the cycle has them installed and verified. RT-X Expedited: Any patch whose P01 deadline would pass before the cycle has it installed and verified: typically a Priority 2 fix released between cycles (PM-12). RT-E Emergency: Every Priority 1 patch: an exploited vulnerability on an internet-facing or Critical system (PM-11). |
| Service check | The system owner, or the service's own health check, confirms the service starts and does its main task within [[30]] minutes of the restart (VF-03). |
| Pass, Fail, N/A | Pass: the evidence shows the check is met. Fail: it is not, or there is no evidence; give the reason. N/A: the check does not apply to this deployment; give the reason. |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| PM-nn, VF-nn, RB-n | Rules of the Patch Management Standard, the checks on this workbook and the rollback criteria of the Patch Deployment Ring & Maintenance Window Plan. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, September 2026. Delete before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 8.8 — Management of technical vulnerabilities | The checklist as a whole: each fix confirmed installed and the vulnerability confirmed gone |
| NIST CSF 2.0 | PR.PS-02 — “Software is maintained, replaced, and removed commensurate with risk” | Deployments and Checks: software maintained, with each update's installation verified |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Who the Implementing Regulation binds: the digital providers its Article 1 names. For others it shows what a regulator expects |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 6.6.1 — “The relevant entities shall specify and apply procedures, coherent with the change management procedures referred to in point 6.4.1 as well as with vulnerability management, risk management and other relevant management procedures, for ensuring that: (a) security patches are applied within a reasonable time after they become available; (b) security patches are tested before being applied in production systems; (c) security patches come from trusted sources and are checked for integrity; (d) additional measures are implemented and residual risks are accepted in cases where a patch is not available or not applied pursuant to point 6.6.2.” | Deadline result and Stragglers: patches applied within a reasonable time, with residual risk accepted through a deferral where one is not |
| DORA — Regulation (EU) 2022/2554 | Article 9(4)(e) — “implement documented policies, procedures and controls for ICT change management, including changes to software, hardware, firmware components, systems or security parameters, that are based on a risk assessment approach and are an integral part of the financial entity’s overall change management process, in order to ensure that all changes to ICT systems are recorded, tested, assessed, approved, implemented and verified in a controlled manner” | Checks: each change verified after it is implemented (financial entities) |
| DORA — Delegated Regulation (EU) 2024/1774 | Article 10(2)(g) — the vulnerability management procedures shall “monitor and verify the remediation of vulnerabilities” | VF-04 and the deadline result: the remediation of each vulnerability monitored and verified (financial entities) |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.