openskills.info
Course catalog
Course Preview

Patch Management

Patch management is the controlled process of finding, prioritizing, testing, deploying, and verifying software and firmware updates across an organization. It reduces security and reliability risk while keeping changes within acceptable service limits.

itInfrastructure and operations

Patch management as preventive maintenance

Patch management is the controlled process of identifying, prioritizing, acquiring, testing, deploying, and verifying software and firmware updates across an organization. A patch changes an existing product to correct a defect, close a vulnerability, improve stability, or maintain vendor support. The work covers operating systems, applications, libraries, device firmware, virtual machines, cloud workloads, network appliances, and other managed technology.

The patch file is only one input. Enterprise patch management is a maintenance system that connects vendor information, asset knowledge, risk decisions, change control, deployment technology, and evidence. NIST frames this system as preventive maintenance: it is an ongoing cost of operating technology, not an exceptional security project.

The operating loop

A durable patch program follows a closed loop:

inventory → monitor → assess → prioritize → acquire → test
    ↑                                             ↓
 verify ← report ← handle exceptions ← deploy in stages

Inventory establishes what exists, which software it runs, who owns it, and which service depends on it. Monitoring collects vendor advisories, package metadata, security bulletins, and threat evidence. Assessment matches an update to affected assets and identifies prerequisites, supersedence, restart behavior, and possible service impact.

Prioritization decides what moves first. Acquisition obtains update content and metadata from trusted sources. Testing checks installation, application behavior, rollback or recovery procedures, and operational monitoring. Staged deployment moves from representative canaries to broader groups. Verification confirms the intended state on each target and checks that the service still works. Exceptions keep unresolved work visible until the update, a compensating control, replacement, or retirement removes the condition.

Continue the course

This section is part of the paid course.

See pricing to subscribe, or log in if you already have access.

Where this skill leads

Relevant careers

See how this topic contributes to broader role-level skill maps.

Sources