CMMC
Patch Management for Small Business: What Gets Patched, When, and Who Checks
Patch management for small business comes down to three questions: what gets updated, how fast, and who proves it happened. Get those right and you close many of the doors attackers use.
Capital Cyber. Sources are listed at the end of the article.
What Does Patch Management for Small Business Actually Cover?
A patch is a fix from the maker of your software or device. Patch management is the routine of finding those fixes, installing them and confirming they worked.
Most owners think of Windows updates. That is only the start. Your list should also include the apps people use every day, such as web browsers, Microsoft Office and PDF readers.
Then come the devices that rarely get attention. Firewalls, remote access gear, Wi-Fi equipment, printers and network storage all run software that needs updates. So do phones and tablets that get company email.
Last is the special software your business runs on. Think dental imaging, tax and accounting packages, or the computer that drives a machine on the shop floor. These often update on the vendor's schedule, not Microsoft's.
Cloud services like Microsoft 365 are patched by the provider. You still own the settings, the accounts and the devices people use to sign in.
Which Updates Should We Install First?
Start with flaws that attackers are already using. CISA, the federal cyber defense agency, keeps a public list called the Known Exploited Vulnerabilities catalog. Federal agencies must fix items on it by set due dates, and it works as a priority list for anyone.
Next, look at anything that faces the internet. Your firewall and remote access gear are the front door. A flaw there can let someone in without a stolen password.
After that, patch the computers people use for email and the web. That is where phishing links and bad attachments land.
How Fast Should Patches Be Installed?
Microsoft releases its main security updates on the second Tuesday of each month. That gives you a natural cycle to plan around. NIST's patching guide treats this as preventive upkeep, planned like any other maintenance.
Our rule of thumb is simple. Routine updates go out within that monthly cycle. Flaws that are being actively exploited go out in days, not weeks.
Speed should not mean chaos. Send updates to a few test machines first, then to everyone. Schedule restarts after hours, because many updates do not take effect until the computer restarts.
What Do We Do with Computers That Cannot Be Updated?
Many businesses have one. It might be an old PC that runs a milling machine or an X-ray sensor. The vendor no longer supports it, or an update would break the software.
You cannot patch it, so you fence it in. Put it on its own network segment. Block it from the open internet and from email, and limit who can sign in to it.
Then write down a plan to replace or upgrade it. An unpatched machine is a known risk. It should be a choice you made on purpose, not one you forgot about.
Who Should Check That Patches Actually Installed?
Someone other than the person who sent them out. Update tools can show a job as done even when a machine was offline, stuck waiting for a restart or quietly failed. A second set of eyes catches that.
Checking starts with a complete list of your devices. You cannot confirm what you do not know you own. Each month, compare that list with the patch report and follow up on any device that has not checked in.
Keep those reports. Insurers, auditors and customers may ask for proof. Defense contractors that handle controlled government data must fix system flaws in a timely manner under NIST SP 800-171, which also comes up under CMMC.
Frequently Asked Questions
4 QUESTIONSWhat does this mean for my business?
It means patching needs an owner, a schedule and a check. Know what devices you have, update them monthly, and rush fixes for flaws attackers are already using. Then have a second person confirm the results. If you use an IT provider, ask them to show you that report each month.
Can I just turn on automatic updates?
Automatic updates help, but they are not enough on their own. They usually cover Windows and some apps, not firewalls, printers or specialty software. Someone still has to confirm the updates installed and handle the devices they miss.
How often should we review patch status?
Review patch status at least once a month, after the main monthly updates land. Check sooner when a known exploited flaw affects something you own, such as your firewall or remote access system.
Do we have to patch our cloud software?
Mostly no, because the cloud provider patches its own service. You are still responsible for the computers and phones that connect to it. You also own the settings and user accounts inside it.
Sources
READ 2026-10-31- CISA Known Exploited Vulnerabilities Catalog
- CISA Binding Operational Directive 22-01
- NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning
- NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information
- Microsoft Security Update Guide
This article explains the regulations and is not legal advice.
Talk it through in 30 minutes.
A call is a conversation, not a pitch. Tell us how your business runs and we will tell you what we would manage.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.