Every system your organization relies on receives updates from time to time. Some are applied right away, some wait for a quiet moment, and some are put off for a good reason. Without a record, nobody can say which systems are current, which are waiting, and who decided to wait. A patch and update record answers those questions in one place.
This article is general information about documentation and planning. It is not legal, compliance or security advice. Recovery targets and technical configuration are decisions for your organization to make with qualified professionals and to record in your own documents, and which obligations apply to you varies by organization, industry and jurisdiction.
What the record is for
The record is a running log. It shows what was applied, where, when and by whom, and it makes deferred updates visible instead of forgotten. It also gives continuity planning a starting point, because the systems in the update record are the same systems in your dependency map.
What to log
| Field | What to write |
|---|---|
| System | The system, by the name used in your dependency map |
| Owner | The person accountable for the system |
| Update | What was applied, in the wording the supplier uses |
| Date applied | When it was applied |
| Applied by | The person or team that applied it |
| Notes | Anything a later reader would need, such as a follow-up check |
Recording a deferred update
Sometimes an update is deliberately put off, for example because a busy period is under way or a dependent system needs to be checked first. Record it as its own entry:
- What is being deferred, and on which system.
- Why, in one plain sentence.
- Who approved the deferral, and when.
- When it will be revisited, as a date rather than “later”.
A deferral with a reason, an approver and a revisit date is a decision. A deferral without them is just a gap.
How to set it up
- List the systems. Start from your dependency map so the names match.
- Name an owner for each. The owner is who you ask about that system’s updates.
- Choose where the log lives. A shared document or spreadsheet is enough, as long as everyone knows where the current copy is.
- Write down the cadence. How often updates are applied is a decision for your organization to make with qualified professionals and to record in your own documents.
- Make logging part of the work. An update is not complete until its entry is written.
Reviewing the record
Review the record on the cadence your organization chooses. Look for systems with no recent entries, deferrals past their revisit date and entries with no owner. Record each review with its date, who took part and what was followed up.
What the record is not
The record shows what was done and decided. It does not show that any system is safe or that a recovery would succeed.
For worksheets and checklists you can start from, see the Free Resources page on this site.