Patch Management for Small Business: A Practical Schedule
Most small offices in Lubbock and across West Texas know updates matter. The trouble is that "install updates" is not a plan. Computers get restarted when someone remembers, the firewall has not been touched since it was installed, and nobody is quite sure whether the accounting software is current. That is how a known, already-fixed hole stays open for months.
Patch management is simply the habit of finding, installing and checking updates on a schedule, so it does not depend on memory. NIST describes it in SP 800-40 Rev. 4 as identifying, prioritizing, acquiring, installing and verifying patches, and frames it as preventive maintenance, a normal cost of doing business rather than an occasional project. Here is a practical way for a small or mid-size office to do that.
Step 1: Know what you actually need to patch
You cannot update what you have forgotten about. Start with a simple list:
Workstations and laptops, including the ones that travel to job sites, farms or home offices
Servers, whether in a closet or in the cloud
Network gear: firewall, switches, Wi-Fi access points and the internet router
Business applications: accounting, practice management, line-of-business software, browsers, PDF readers
Microsoft 365 and other cloud apps, where the vendor patches the service but you still control settings and add-ins
Odd devices: printers and copiers, cameras, door controllers, NAS boxes and anything else with a login page
Next to each item, note who is responsible for updating it. For a ten-person office in Levelland or Brownfield, that list may fit on one page. The point is that every item has a name next to it.
Step 2: Separate routine updates from urgent ones
Not every update needs the same speed. A useful way to think about it is two tracks.
The routine track. Microsoft publishes its monthly Windows security update on the second Tuesday of each month, often called Patch Tuesday, according to Microsoft Learn. Microsoft also notes that most organizations treat these monthly security updates as mandatory, and that the updates are cumulative. That makes the second week of the month a natural anchor for your regular patch cycle.
The urgent track. Some vulnerabilities are being used by attackers right now. CISA keeps a Known Exploited Vulnerabilities (KEV) catalog listing flaws with reliable evidence of active exploitation and a clear fix. Federal agencies are required to fix those within set timeframes, and CISA strongly recommends that every organization, including private businesses, prioritize them too. If something you run shows up on that list, it should not wait for next month.
Microsoft can also release out-of-band updates for urgent issues outside the normal monthly cycle, so someone needs to be watching for those as well.
Step 3: A simple monthly schedule
Here is a schedule many small offices can live with. Adjust the days to fit your business, but keep the order.
Week 2: Patch Tuesday arrives.
Review what Microsoft and your other key vendors released.
Check whether anything is flagged as actively exploited or appears on the KEV catalog. Those move to the urgent track.
Week 2 to 3: Test on a small group first.
Install the updates on a few machines that represent your office, such as one front desk PC, one manager laptop and one machine running your main business software.
Have those users confirm that printing, scanning and your key applications still work.
Week 3: Roll out to everyone else.
Push updates to the rest of the workstations and laptops.
Schedule restarts after hours so people are not interrupted mid-task. Many updates do not finish until the device restarts.
Patch servers in a planned maintenance window, after confirming you have a recent backup that restores.
Week 4: Verify and clean up.
Check a report, not a feeling. Which devices are still missing updates, and why?
Chase down the laptop that has been in a truck for three weeks.
Update third-party apps and browsers that were not covered by Windows Update.
Quarterly: The things people forget.
Firewall, switch and Wi-Fi firmware
Printers, copiers and other network devices
A review of your device list for anything new, retired or unknown
The step most offices skip is verification. NIST includes verifying the installation as part of patch management for a reason: an update that was "pushed" but never finished installing protects nothing.
Step 4: Plan for devices that cannot be patched
Sometimes the fix is not an update. A computer may be running software that is past its end of support, or an old device may simply have no more updates coming. Microsoft ended support for Windows 10 on October 14, 2025, which means those computers no longer receive regular security updates unless they are enrolled in Microsoft's Extended Security Updates program (Microsoft Windows 10 end of support).
CISA's guidance for known exploited vulnerabilities is straightforward: apply updates per vendor instructions, and if a product is end-of-life or otherwise cannot be updated, remove it from the network. If a device truly must stay, for example a machine that runs older equipment in a shop or a scale house, isolate it on its own network segment, limit who can reach it, and make a plan to replace it.
Step 5: Do not forget remote and field devices
Across the South Plains, a lot of work happens away from the office. Laptops sit at cotton gins during harvest, in pickups between oilfield sites in the Permian Basin, or in home offices from Amarillo to Abilene. Those devices often miss the patch window because they are offline or never restart.
A few habits help:
Use management tools that can update devices over the internet, not just on the office network.
Set a firm restart deadline so updates cannot be postponed forever.
Review the "missing updates" report specifically for laptops that rarely come back to the office.
Patching works best with other layers
Patching closes known holes, but it is one layer. Endpoint detection and response (EDR) can catch suspicious behavior on a machine that has not been updated yet, and we cover the difference in our post on EDR vs antivirus. Regular vulnerability assessments can find the systems your patch tool is not seeing at all, and good network management keeps the firewall and switches on the schedule too.
Questions to ask whoever handles your updates
Whether that is an employee, an outside provider or you on Saturday mornings, ask:
Do we have a current list of every device and application that needs updates?
What is our monthly patch schedule, and who signs off that it happened?
How do we handle updates for actively exploited vulnerabilities between cycles?
Which devices are currently missing updates, and why?
Which of our systems are past end of support, and what is the plan for them?
If nobody can answer these quickly, that is your sign the process needs attention.
How Double Technologies helps
Double Technologies handles patching as part of managed IT services for businesses in Lubbock and across West Texas, including Windows, servers, third-party applications and network devices, with reporting so you can see what was updated and what still needs work. Our team brings 30 years of combined experience, and we can work remotely or come to you when a device needs hands on site. Our hours are Monday through Friday, 8 AM to 7 PM, and Saturday, 9 AM to 5 PM Central.
If you are not sure what is missing updates in your office right now, call Double Technologies at (806) 319-8521. We will help you build a patch schedule that fits how your business actually runs.
Comments