Patching fails at small teams not because anyone disagrees with it, but because it has no when. "We patch when we get to it" means the scary updates happen during incidents and the boring ones never happen at all. This is the calendar that fixes that — four lanes, three anchors, a deferral card, one evidence page.
1. The four lanes: every patch lands in exactly one
- Lane 0 — emergency (24 hours). Actively exploited vulnerabilities (CISA KEV hits), exposed-service CVEs with public exploits, anything touching internet-facing auth. Patch inside 24 hours, outside business hours if needed, note in the log that you did it hot. Emergency patches are allowed to be messy; they are not allowed to be skipped.
- Lane 1 — high (7 days). CVSS 9+ on internal systems, any CVE in your identity provider, RCE on machines with user data. These ride the next maintenance window, never the one after that.
- Lane 2 — the monthly wave. Everything else: routine OS updates, app releases, firmware you've been meaning to do. One wave per month, all machines, one afternoon, same reboot-and-verify pass. The wave is the heartbeat — when it's reliable, Lanes 0 and 1 stay rare.
- Lane 3 — the quarterly sweep. The things too big or too scary for the wave: hypervisor hosts, NAS firmware, firewall OS, the backup server nobody dares reboot. One per quarter, with a tested snapshot first.
2. Calendar anchors that survive busy weeks
- Anchor to Patch Tuesday, not to memory. Microsoft ships the second Tuesday; most vendors follow within days. Your monthly wave lives on the third Tuesday: seven days of vendor dust-settling, then one pass. Recurring all-day event, named "PATCH WAVE", unmovable.
- Give the wave a window with a name. Same afternoon every month. The team plans around it, and your change-freeze policy can treat it as protected time — during the wave, nothing else competes for the admin's hands.
- Stack cadence on cadence. Wave day follows the weekly review; the quarterly sweep follows drill day. Cadence stacked on cadence survives; cadence floating alone dies in the first busy sprint.
- The 24-hour pre-wave check. Day before: read advisories, list machines in scope, confirm console access for the two that always need it. Fifteen minutes converts wave day from archaeology into execution.
3. The deferral card: skipping is legal, silent skipping is not
- Every deferral gets four lines: what, why (the concrete risk of patching now), when it will be patched (a date, not "soon"), who accepted it. A deferral without a date is not a decision; it is a deletion.
- Deferrals expire loudly — the date is a calendar entry, not a hope. On expiry the patch fronts the next wave automatically.
- CAP it: any machine with two live deferrals stops receiving new ones and becomes the next wave's first target.
4. The vendor EOL watch: the calendar item nobody schedules
Patching cannot save software that stopped shipping patches. The quiet catastrophe at small teams is the EOL system — the old NAS firmware, the abandoned wiki app — that is unpatchable by definition. Quarterly: walk the asset inventory, mark everything whose vendor support ends within twelve months, and give each a written fate: replace, migrate, or accept-with-compensation (network isolation, no internet exposure). "Accept" is allowed; "ignore" is not.
5. The one-page evidence report
- Log every wave in three columns: machine, patches applied, result. When an auditor, insurer, or customer security questionnaire asks "do you patch regularly?", you'll have eleven consecutive wave reports instead of a shrug.
- Report misses with the same calm as hits: "September wave: 14/15 patched, 1 deferral (billing server, vendor regression, expires 15 Oct)."
- A missed Lane 2 wave is a scheduling conversation; a missed Lane 0 is an incident and gets a postmortem.
The honest small-team version
A five-person company does not need a patch management platform; it needs a recurring calendar event and a log file. The trap this system prevents is cadence theater — a beautiful policy document with no calendar entry behind it. If the PATCH WAVE event is not in your calendar right now, the cadence does not exist yet.
The full one-page version lives on our site: Patch Cadence Calendar for Small Teams — along with related notes on the patch management checklist, the change freeze window policy, and the severity matrix.
If you want templates instead of prose: the Ops Starter Kit ($14) covers incident response, and the Automation Starter Pack ($19) covers the pick-first automations.
Top comments (0)