Patch management
Patch management is the process of identifying, prioritizing, obtaining, deploying, and verifying software updates across an organization's systems.
Turning on automatic updates can help deliver patches. Patch management also needs to account for systems that are offline, unsupported, excluded from deployment, or waiting for a restart before an update takes effect.
NIST treats patching as preventive maintenance. Its guidance includes preparation, deployment, verification, and continued monitoring. A deployment job completing is not enough if the intended update has not taken effect on the affected system.
Product controls help with that work. Windows Update client policies, for example, support managing update delivery and rollout timing. Those controls do not cover every application or device in an organization’s inventory.
When a patch cannot go out yet
An incompatible application or unavailable device does not make the vulnerability disappear. Record which systems remain exposed, who owns the delay, and what temporary restrictions reduce the risk. NIST includes alternatives such as isolating a system or removing vulnerable software when patching is not feasible.
Keep that work separate from reporting the patch as complete. Security hardening can reduce what a system exposes while an update is pending, but it may not remove the underlying flaw. Verification should establish that the intended update took effect, including any required restart.