IOMG Technical Standards: Patching
Patching is a crucial step in maintaining our security and performance, as such we want to make sure it is completed efficiently.
Applications
Widely used applications that have a trusted and reliable auto-update function will be configured to utilise this function in order to minimise the management overhead. Where possible the auto-update function should be configured to update from a central internal repository or to utilise peer-to-peer sharing limited to the internal network.
Operating System
Updates to Microsoft operating systems will continue to utilise WSUS. Client updates will deploy automatically to all GTS users on the day they are released by Microsoft. The following week updates will be deployed to the group of key users around Government along with an email notification the day before to remind them and draw their attention to any particularly notable changes. After a further week they will be realised to all remaining users. Servers updates are deployed according to the agreed maintenance schedules for each server, typically 3am and all servers are patched within a week of updates being released by Microsoft.
Other OS updates should follow the same principal of Critical and Security updates being applied within a week of release.
Drivers and Firmware
Drivers and Firmware updated should be reviewed and updated on a quarterly basis.