Patch Management and SLAs

Prioritization tells you what to fix; patch management is the disciplined process that actually drives those fixes to completion, on time, and across the whole estate.

SLAs (service level agreements) define how fast different severities must be remediated. Without them, urgent fixes slip and accountability evaporates.

A repeatable cycle keeps systems current:

• Identify available patches (vendor advisories, scan results).
• Assess relevance and risk of applying.
• Test in a non-production environment.
• Deploy in controlled waves.
• Verify the patch applied and the system is healthy.

Each step has owners and evidence, mirroring the wider VM lifecycle.

An SLA converts intent into a deadline. It sets the maximum allowed time from discovery to remediation, tiered by severity. Example targets:

• Critical / KEV: 7-15 days (or faster for internet-facing).
• High: 30 days.
• Medium: 90 days.
• Low: best-effort / next cycle.

SLAs make aging measurable and create pressure to close, not just acknowledge.

Tie the clock to real risk, not just CVSS. A KEV-listed or internet-facing critical should have a tighter SLA than an internal medium.

Reference frameworks help: CISA mandates KEV remediation within set deadlines for federal agencies, and many enterprises adopt similar accelerated timelines for actively exploited vulnerabilities regardless of CVSS.

Patches can break things. Testing in staging catches regressions before they hit production:

• Apply to a representative test group first.
• Validate critical functionality and performance.
• Confirm no conflicts with existing software.

Balance speed and safety: for a KEV exploited in the wild, accept more risk and patch faster than for a routine update.

Deploy in waves (ring deployment): pilot group, then broader rings, then everything. Monitor health at each ring before advancing.

Always have a rollback plan: snapshots, package downgrade, or config restore. If a patch causes an outage, you must be able to revert quickly while you investigate.

Manual patching does not scale. Use centralized tooling:

• WSUS / SCCM / Intune for Windows.
• Config management (Ansible, Puppet, Chef) for Linux fleets.
• Golden/base images rebuilt with patches for cloud and containers.

Automation enforces consistency and shrinks the window between patch release and deployment.

Sometimes you cannot patch immediately: vendor delay, fragile legacy system, or required uptime. Apply compensating controls to reduce risk in the meantime:

• Network segmentation / firewall rules.
• Virtual patching via WAF or IPS signatures.
• Disabling the vulnerable feature or service.

These buy time but are not a permanent substitute for the real fix.

End-of-life systems may have no patch at all. Options:

• Isolate them on a restricted network segment.
• Wrap them in strict access controls and monitoring.
• Plan migration/decommission with a deadline.
• Formally accept the residual risk with an expiry date.

Document everything; an unpatchable system left undocumented is an audit and breach risk.

Track whether the program actually meets its commitments:

• MTTR by severity versus the SLA target.
• SLA compliance rate (percent closed within deadline).
• Overdue / aging findings by team and asset.
• Patch coverage (percent of fleet current).

Report by owning team so accountability is visible and slow areas get attention.

After deployment, verify: re-scan to confirm the CVE is gone and the system is healthy, then close the finding with evidence. Feed recurring problems (a library that keeps reappearing, a chronically late team) back into process improvement.

Patch management done well turns prioritized risk into measurable, on-time risk reduction.

Confirm the role of remediation SLAs.

Patch management drives prioritized findings to completion through identify, assess, test, phased deploy, and verify, backed by rollback plans and automation. SLAs set severity- and risk-tiered deadlines (tighter for KEV/internet-facing) so fixes land on time.

Where patching is impossible, use compensating controls and documented, time-boxed risk acceptance. Measure MTTR, SLA compliance, and coverage, and feed lessons back into the lifecycle.