Information Security Management
Patch Management Policy: What ISO 27001 and Cyber Essentials Expect, With a Free Template
A patch management policy says how quickly you fix known weaknesses in your software and systems, and how you know they are fixed. It is one of the few policies with hard numbers in it, which is also why it is one of the easiest to fail. ISO 27001 asks for it under Annex A control 8.8, management of technical vulnerabilities, and Cyber Essentials sets a specific deadline for the serious ones: 14 days.
The complete toolkit, every policy, template and record you need. Free, no commitment
This guide covers what the control requires, the timescales that auditors and Cyber Essentials assessors expect, what to put in the policy, how to handle the patches you cannot apply, and the template from our toolkit.
Free patching and vulnerability management policy template (Word)
The template covers purpose and scope, roles, the four-stage process (identification, assessment and prioritisation, remediation, verification and reporting), a severity table with remediation timescales, exception management, compliance and review. Replace the placeholders and adjust the timescales to what you can actually meet.
It is one of 18 policy templates in the free ISO 27001 toolkit, which also has a patch management SOP and a vulnerability management SOP for the operational detail.
What control 8.8 requires
Control 8.8, management of technical vulnerabilities, says that information about technical vulnerabilities of information systems in use shall be obtained, the organisation’s exposure to such vulnerabilities evaluated, and appropriate measures taken. Three verbs, and the policy needs a process for each:
- Obtain. Know what you are running (which needs an asset inventory, control 5.9), and find out when it has a vulnerability: vendor advisories, NCSC alerts, a vulnerability scanner, your managed service provider.
- Evaluate. Decide how serious each one is for you, usually by severity score adjusted for whether the system is exposed to the internet and what it holds.
- Act. Patch, upgrade, reconfigure, isolate or accept the risk, within a timescale set by severity, and record that you did.
The control also expects you to tell people what they must not do: no installing unapproved software, no disabling updates. That part usually lives in the acceptable use policy.
The timescales that matter
ISO 27001 does not set a number of days; it says “appropriate”. Cyber Essentials does set one, and because most UK small businesses hold or want both, the Cyber Essentials figure is the one to design around.
| Severity | CVSS score | Cyber Essentials requirement | Typical ISO 27001 policy |
|---|---|---|---|
| Critical | 9.0 to 10.0 | Within 14 days of the patch being released | 7 days |
| High | 7.0 to 8.9 | Within 14 days | 14 days |
| Medium | 4.0 to 6.9 | No fixed deadline | 30 days |
| Low | 0.1 to 3.9 | No fixed deadline | Next maintenance window, or risk-accepted |
Cyber Essentials treats anything rated critical or high (CVSS 7.0 and above), and anything the vendor calls critical or high-risk, as needing a fix within 14 days, on every in-scope device including phones and laptops. Since v3.3 of the scheme, unsupported software with no patches available has to be removed or taken out of scope. If you set your ISO 27001 policy to 14 days for high and 7 for critical, you satisfy both and have something you can actually achieve.
What to put in the policy
- Scope. Every system, device, application and cloud service you own, operate or are responsible for, including staff laptops and phones, and systems run for you by a managed service provider.
- Roles. Who scans, who assesses, who patches each class of system, who approves exceptions, and what your MSP is responsible for (and that it has agreed to this policy).
- Identification. How you find out: automatic updates where possible, a vulnerability scanner for servers and cloud infrastructure (monthly at least), vendor and NCSC advisories, and ad hoc scans when something big is announced.
- Assessment. The severity scale you use (CVSS is the convention) and how you adjust it for exposure: an internet-facing server with a medium vulnerability may need treating as high.
- Remediation. The timescales by severity; test before deploying where it matters; automated patching for endpoints and standard software; compensating controls where a patch is not available.
- Verification. Rescan or check after patching, and keep the records: what was patched, when, by whom, and what is outstanding.
- Exceptions. How a patch that cannot be applied is risk-accepted, who signs it off, what compensating controls go in, and when it is reviewed.
- Reporting. A simple monthly or quarterly summary: vulnerabilities found, fixed within target, overdue, exceptions open. This feeds management review.
- Review. Annually, and when the threat landscape or your systems change.
A small business version that works
For a 20-person company on Microsoft 365 with laptops, a few SaaS tools and perhaps a cloud environment, the working process is simpler than the policy makes it sound:
- Endpoint updates are automatic and enforced (Intune, Jamf, or at least the operating system’s own setting that users cannot turn off), with a report that shows which devices are behind.
- Browsers and common applications update themselves; the policy says users must not disable this.
- SaaS providers patch their own platforms; your job is to confirm that in supplier reviews, not to patch them.
- Cloud infrastructure and anything self-hosted gets a monthly scan, and the critical and high findings go into a tracker with a due date.
- A monthly ten-minute check produces the evidence: a device compliance screenshot, the scan summary, the tracker.
That is a complete control 8.8 implementation for most small businesses, and it is also what a Cyber Essentials Plus assessor will test.
Handling the patch you cannot apply
Every business has one: the application that breaks on the latest version, the device the vendor no longer supports, the server that cannot be rebooted during business hours. The policy has to have a path for these, because the alternative is that they are quietly ignored.
The path is a documented exception: what the vulnerability is, why the patch cannot be applied, what compensating control is in place (network isolation, removing internet exposure, extra monitoring, a planned replacement date), who accepted the risk, and when it will be reviewed. An exception register with three entries, each reviewed quarterly, is a strong audit position. An unpatched server that nobody has written down is a major finding.
Mistakes I see most at audit
- No scanning. The policy says vulnerabilities will be identified; in practice nobody looks. The auditor asks for the last scan report and there is none.
- Timescales nobody meets. The policy says 48 hours for critical. The records show six weeks. Set numbers you can keep.
- Phones and laptops forgotten. Servers are patched; the laptops are months behind and nobody knows which ones.
- End-of-life software. Windows versions out of support, old router firmware, a legacy application on an unsupported database. Cyber Essentials fails these outright.
- MSP assumed. “Our IT company does that.” The contract does not say so, and the MSP has never seen the policy.
- No records. Patching happens, but there is nothing to show the auditor.
Where to go next
Patch management depends on knowing what you have, so start with the asset inventory (control 5.9) if you do not have one. The cloud security policy covers the services you do not patch yourself, and the Cyber Essentials vs ISO 27001 guide explains how the two schemes overlap on this control. For the full control set see the Annex A guide and the controls list; other policy guides are on the ISO 27001 policies hub. For help getting an ISMS to certification, our ISO 27001 consultancy service covers the technical controls with you.
Frequently asked questions
How quickly does ISO 27001 require patches to be applied?
ISO 27001 does not set a number of days; control 8.8 says appropriate measures must be taken. Most policies use 7 days for critical, 14 for high and 30 for medium vulnerabilities. Cyber Essentials does set a deadline: critical and high-risk patches within 14 days of release.
What is the difference between patch management and vulnerability management?
Vulnerability management is the whole process of finding, assessing and dealing with weaknesses in your systems. Patch management is the most common way of dealing with them, by applying the vendor’s fix. One policy usually covers both, as the ISO 27001 control does.
Do I need a vulnerability scanner for ISO 27001?
Not by name, but you need a way of obtaining information about vulnerabilities in the systems you run. For endpoints and SaaS, vendor update mechanisms and supplier assurance are usually enough. For servers and cloud infrastructure, a scanner run at least monthly is the practical way to meet the control and to produce evidence.
What if a patch cannot be applied?
The policy needs an exception process: document the vulnerability, why the patch cannot be applied, the compensating control (isolation, removing exposure, extra monitoring, a replacement date), who accepted the risk and when it will be reviewed. A documented, reviewed exception is acceptable; an unpatched system nobody has recorded is a finding.
Does patch management apply to phones and laptops?
Yes. Control 8.8 covers every information system in use, and Cyber Essentials explicitly includes mobile devices and laptops in scope. Enforced automatic updates with a compliance report are the usual answer for small businesses.
ISO 27001 Online Course + Full Toolkit
Stop guessing. Follow a proven step-by-step process.
“Highly recommended for anyone looking to understand ISO 27001, whether attempting it on your own or even using a consultant.“
Verified customer review
£285
Instant access
✓ Full toolkit included ✓ Learn as you build ✓ 12-month access ✓ 6 hours of video ✓ Call + email support
Author Background
This article was written by Alan Parker, an ISO 27001 consultant and founder of Iseo Blue Limited. He helps UK SMEs achieve certification in 90 days or less, often without a dedicated security team or a large budget.
With over 30 years in IT governance and information security, Alan works with software companies, IT service providers, managed service providers, and professional services firms across the UK, Europe, and internationally.
Qualifications: Certified ISO/IEC 27001:2022 Lead Auditor,
ITIL v3 Expert, ITIL v4 Bridge, PRINCE2 Practitioner. Named IT Project Expert of the Year (2024, UK). Alan writes in plain English for busy teams who need to get things done.
Connect on LinkedIn or Bluesky, or explore his free ISO 27001 tools and templates at iseoblue.com. B.Sc (Hons) Information Systems, CISMP certified.
