Patch management for small businesses: a routine that holds

In most small and mid-size organizations the problem is not that nobody has heard of patching. It is that patching slips. A laptop that has not restarted in five weeks, a firewall nobody wanted to reboot during busy season, a line-of-business server that "can't be touched", an old PC under the reception desk that stopped receiving updates years ago. Each one is a known, published flaw waiting for someone to use it.

The Canadian Centre for Cyber Security puts patching operating systems and applications second on its list of the top ten IT security actions for organizations.[2] It also advises that when a vendor issues a patch for a security issue, your organization should take steps to apply it as soon as possible.[1] This guide is for owners, office managers and IT leads at Toronto and Canadian organizations who want a patch routine that actually holds up month after month, without breaking the systems people rely on.

Why patching slips in small organizations

Patching rarely fails for technical reasons. It fails because nobody owns it, because a restart is inconvenient at the moment it is offered, and because one bad update years ago taught everyone to wait. NIST describes exactly this divide between business owners and technology teams about the value of patching, and argues that patching should be treated as preventive maintenance: a normal cost of doing business, like servicing a vehicle fleet.[3]

NIST is also realistic about the risk on the other side. Some updates will cause problems. Its advice is not to delay out of fear, but to be prepared to deal with problems when they occur, and to decide in advance how you will respond, because assessing every new vulnerability from scratch is not feasible for most organizations.[3] That is the whole point of a routine: the decisions are made once, calmly, and then followed.

Start with what you own and who owns it

You cannot patch what you have not listed. Before changing any settings, build a simple inventory and split it into maintenance groups, which is how NIST frames it: groups of assets with similar update needs and similar tolerance for downtime.[3] For a typical small organization that looks like this:

• Staff laptops and desktops. Windows and macOS, plus the browsers, PDF readers and collaboration apps on them.
• Servers and line-of-business systems. File servers, accounting or practice-management software, anything with a vendor who must approve updates.
• Network and security devices. Firewalls, VPN gateways, Wi-Fi controllers, switches and their firmware.
• Everything else with an IP address. Printers, door controllers, cameras, conference room devices.

Give each group a named owner and a maintenance window that suits the business. A group without an owner is the one that will be found unpatched later.

A monthly rhythm built around Patch Tuesday

Microsoft publishes its monthly Windows security update on the second Tuesday of each month. These updates are cumulative, include both new and earlier security fixes, and most organizations treat them as mandatory. Microsoft also ships out-of-band releases when an urgent issue cannot wait for the next cycle.[5] A predictable release date makes a predictable routine possible.

Rings: a small group first, then everyone

In Microsoft Intune, Windows update rings control when updates install, how long they can be deferred, and when devices must restart. Microsoft describes using them to create deployment stages such as test, pilot and production, by assigning different settings to different device groups.[6] A practical shape for a small organization:

• Pilot ring. A handful of devices, including at least one person from finance and one from operations, who receive the update first and report anything odd.
• Broad ring. Everyone else, a few days later, once the pilot has run normally.
• Sensitive systems. Devices that run specialized software, updated in a planned window after the broad ring, with the vendor's guidance checked.

If the pilot finds a real problem, an administrator can pause a ring for up to 35 days, or uninstall the latest quality or feature update from the devices in that ring.[6] Knowing those controls exist is what lets you move quickly without gambling.

Deadlines, so updates actually land

The most common gap is not a missing policy but an update that downloaded and never finished because the user kept postponing the restart. Update ring settings let you defer quality updates by 0 to 30 days, set a deadline of 2 to 30 days after which they install automatically, and add a grace period of 0 to 7 days before a restart is forced. Microsoft recommends allowing devices to restart automatically outside active hours before the deadline, so the restart happens when nobody is using the device.[7] Short deferrals and firm deadlines are what turn "updates are turned on" into "updates are installed".

Note that these Intune policies apply to business editions of Windows such as Pro and Enterprise.[6] If some machines still run Home edition, that is a finding in itself.

When the monthly rhythm is not fast enough

A routine cycle is right for most updates. It is wrong for a flaw that attackers are already using. NIST calls this emergency patching: handling a severe or actively exploited vulnerability as quickly as possible, and treating it as part of incident response if a system may already be compromised.[3]

The simplest trigger to adopt is the Known Exploited Vulnerabilities catalogue maintained by the US Cybersecurity and Infrastructure Security Agency. It lists vulnerabilities with reliable evidence of active exploitation and a clear remediation action, and the agency recommends that every organization use it as an input to prioritization and include a requirement to address listed vulnerabilities immediately.[4] In practice that means one rule: if something you run appears on that list, it skips the queue.

When no patch exists yet, vendors often publish a temporary workaround. The Cyber Centre advises tracking every workaround, replacing it with the real patch as soon as one is available, and removing the workaround afterwards.[1]

Decide the fast lane before you need it. Write down who can approve an emergency update outside the normal window, how staff will be told about an unplanned restart, and what happens if the fix breaks something. Making those calls in the middle of an active threat is how a quick fix turns into a long disruption.

What Windows Update does not cover

A well-run Windows ring program can still leave the riskiest systems behind. Three areas need their own line in the routine:

• Third-party applications. Browsers, PDF tools, remote access software and line-of-business apps each have their own update mechanism. Use your management tooling or the vendor's automatic updates, and verify the versions rather than assuming.
• Firewalls, VPNs and other edge devices. These face the internet directly and are often patched least, because a reboot interrupts everyone. Schedule a window, take a configuration backup first, and keep a tested way back.
• Unsupported systems. Devices the vendor no longer updates carry vulnerabilities that will never be fixed. The Cyber Centre recommends replacing them once software support ends,[1] and the agency behind the exploited-vulnerabilities catalogue encourages every organization to remove end-of-life products that cannot be updated.[4] Windows feature releases have a fixed support life, 24 months for Pro and 36 months for Enterprise editions,[5] so plan upgrades before that date arrives, not after.

Prove it worked

Both the Cyber Centre and NIST end the patch process with the same step: verifying that the update was actually installed.[1][3] A deployment tool reporting "success" is not the same as a device that is on the current version. Once a month, review a simple report: devices not on the latest cumulative update, devices that have not checked in, edge devices behind their vendor's current release, and any open exception with its owner and review date. The Cyber Centre also recommends backing up data before patching,[1] so check that backups ran too.

That one-page report is what an owner or board should see. It turns patching from an invisible chore into a measurable control, and it shows quickly which group is slipping.

Where this fits

Our vulnerability and patch management service sets up this routine: the inventory and maintenance groups, update rings and deadlines in Microsoft 365 and Intune, an emergency lane tied to known exploited vulnerabilities, and a monthly verification report. For organizations that would rather not run it themselves, our managed IT services keep the cycle going and report on it, and our Microsoft 365 work covers the Intune configuration behind it.

If you are not sure how far behind your devices really are, contact HAI Consulting for a free initial consultation. We will look at how updates reach your laptops, servers and network devices today, show you where the gaps are, and propose a patch cadence your team can keep.