It's 3 p.m. on a Friday. Your firewall vendor publishes an advisory: a critical flaw lets attackers bypass VPN authentication. Your outsourced IT tech is off, the update needs a reboot, and the weekend is about to start. Who makes the call? How fast? Without a written policy, the answer is almost always "we'll deal with it Monday."
That grey zone is exactly what attackers count on. They don't need exotic zero-days. The U.S. agency CISA maintains a public catalogue of Known Exploited Vulnerabilities (KEV), updated continuously. To a criminal group, a flaw the vendor has fixed but you haven't is an unlocked door.
A good patch management policy fits on two pages. It answers three questions: what gets patched, how fast, and what happens when you can't. Here's how to build one for a small or mid-sized business.
TL;DR
- A useful policy sets deadlines by severity, not a vague promise to "stay current."
- CVSS scores aren't enough: an actively exploited (KEV) flaw on an internet-facing device jumps the queue.
- Every exception (legacy software, a shop-floor PC) needs documentation, a compensating control and an expiry date.
- Two monthly metrics are enough to tell whether the policy is actually working.
What the policy needs to cover
A patch policy isn't a legal document. It's a clear agreement between leadership and whoever does the work, whether that's an in-house IT person or a managed service provider (MSP). It covers seven things.
- Scope. Laptops and servers, but also firewalls, routers, VPN appliances, NAS devices, printers, phones, firmware (BIOS) and third-party apps: browsers, PDF readers, accounting software, website plugins.
- Roles. Who patches, who verifies, who approves exceptions.
- Inventory. You can't patch what you don't know you have.
- Monitoring. Canadian Centre for Cyber Security alerts, vendor advisories and the KEV catalogue.
- Deadlines. By severity and exposure (see the table below).
- Deployment. Pilot group, forced reboots, a verified backup before server patching.
- Exceptions and reporting. A register, compensating controls, a monthly report.
Take a 20-person engineering firm in Ottawa. Its MSP handled Windows updates well, but nobody owned the backup NAS or the WordPress plugins on the company website. Neither blind spot appeared anywhere in writing. The policy simply named them and assigned an owner.
Target patch deadlines by severity
These are the deadlines our team recommends as a starting point for a small business. They're internal targets, not legal standards: tune them to your reality, but write them down.
| Situation | Examples | Target deadline | If you can't meet it |
|---|---|---|---|
| Critical, actively exploited (KEV) and internet-facing | VPN, firewall, email gateway, website | 72 hours maximum, ideally 24–48 h | Apply the vendor's mitigation or shut the service off the same day |
| Critical (CVSS 9.0–10.0), not exposed | File server, domain controller | 7 days | Restrict network access to the system |
| High (CVSS 7.0–8.9) | Browsers, office suite | 14 days | Disable the vulnerable feature |
| Medium (CVSS 4.0–6.9) | Internal applications | 30 days (monthly cycle) | Documented exception |
| Low (CVSS 0.1–3.9) | Rarely used components | 90 days or next cycle | Documented exception |
The first row matters most. When a VPN flaw is being mass-exploited, attackers are often a step ahead. After patching, check the device logs for suspicious sessions: a patch doesn't evict an intruder who's already in. CISA's BOD 26-04, issued in June 2026, takes the same view, requiring U.S. federal agencies to remediate and complete forensic triage within three days in the highest-risk cases.
Prioritizing: CVSS doesn't tell the whole story
A CVSS score measures a flaw's technical severity on a 0-to-10 scale. It doesn't tell you whether anyone is actually exploiting it. Two other sources fill the gap:
- The KEV catalogue confirms a flaw is being exploited in the wild.
- The EPSS score, published by FIRST, estimates the probability that a flaw will be exploited in the next 30 days.
BOD 26-04 dropped deadlines based on CVSS alone. Instead, it prioritizes using four questions any small business can borrow: Is the asset exposed to the internet? Is the flaw in the KEV catalogue? Can exploitation be automated? Does the attacker gain partial or total control?
Example: a wholesale distributor in Laval gets a scan report showing a 9.8 on an internal printer and a 7.5 on its VPN, listed in KEV. The VPN goes first, no debate. That kind of entry point is how many ransomware attacks begin.
The monthly cycle in practice
Microsoft releases its patches on the second Tuesday of every month (Patch Tuesday). It makes a good metronome for the whole company.
- Week 1: pilot group. Two or three machines, including the most tech-savvy user's, get patches first.
- Week 2: general rollout. If nothing breaks, everyone follows. Set a grace period, then force the reboot.
- Scheduled window: servers. A weeknight, after confirming the previous night's backup succeeded. If you're not sure about your copies, read our guide to the 3-2-1-1-0 backup rule.
- Every month: everything else. Third-party apps, firmware for the firewall, NAS and printers, website plugins.
The Canadian Centre for Cyber Security recommends enabling automatic updates wherever possible and replacing products the vendor no longer supports. For a small business, that's the best effort-to-security ratio: automate the routine and save human attention for emergencies.
Exceptions: when you can't patch
Some systems can't be updated quickly. A PC running a CNC machine, a line-of-business app that needs an old Java version, a computer still on Windows 10, which reached end of support on October 14, 2025.
An exception is acceptable. A forgotten exception isn't. Each entry in the register states:
- the system and the reason for the exception;
- the risk, in one sentence leadership can understand;
- the compensating control: network isolation, no internet access, multi-factor authentication, application allow-listing;
- the expiry date and who approved it.
For end-of-life edge devices (firewalls, routers, VPN appliances), there's no satisfying compensating control: replace them. CISA even issued a separate directive (BOD 26-02) on that problem alone.
Measure it and prove it works
A policy nobody measures quickly becomes wishful thinking. Two metrics are enough:
- Compliance rate: the percentage of devices patched within the deadlines in the table.
- Age of the oldest missing critical patch across the whole fleet.
Show them to leadership monthly, on one page. The same numbers will help you answer your cyber insurance questionnaire without guesswork.
Rollout checklist:
- The inventory includes the firewall, NAS, printers and third-party apps.
- Severity-based deadlines are written down and approved by leadership.
- Someone is subscribed to Cyber Centre alerts and watches the KEV catalogue.
- A pilot group gets patches before everyone else.
- Reboots are forced after a grace period.
- An exception register exists, with expiry dates.
- A vulnerability scan verifies the results at least quarterly.
- The monthly report goes to leadership.
If your fleet keeps falling behind or the exceptions never close, our team can handle the catch-up and system hardening through our remediation and hardening service. What matters is getting started: a written deadline table beats a perfect intention.
Frequently asked questions
Are automatic Windows updates enough for a small business?+
They cover a large share of the risk, and the Canadian Centre for Cyber Security recommends turning them on wherever possible. But they don't touch your firewall, NAS, printers or most third-party software. You also need to confirm they actually install: a laptop that hasn't rebooted in three weeks isn't up to date.
What should we do if a patch breaks our accounting or line-of-business software?+
Roll the patch back on the affected machines, document the issue and open a ticket with the software vendor. The system then becomes a temporary exception with a review date. Deploying to a small pilot group first is exactly how you keep this kind of surprise contained.
Can my cyber insurer require a patch management policy?+
Cyber insurance questionnaires frequently ask how and how quickly you apply patches, especially on internet-facing systems. A written policy backed by a recent compliance report makes your answers verifiable. Answer accurately: a misstatement can complicate a claim.
Who should approve the patch policy in a company without an IT department?+
Leadership, ideally the person who owns the business risk. Your managed service provider can draft and run the policy, but the business decides what delays are acceptable and signs off on exceptions. Review it once a year.
Sources
- 1.Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations
- 2.Canadian Centre for Cyber Security: How updates secure your device (ITSAP.10.096)
- 3.CISA: Known Exploited Vulnerabilities Catalog
- 4.CISA: BOD 26-04, Prioritizing Security Updates Based on Risk (June 2026)
- 5.FIRST: Common Vulnerability Scoring System v4.0
- 6.FIRST: Exploit Prediction Scoring System (EPSS)