Your Business Is 16 Days Away From a Breach.
Every Month.

Yes. The Patch Management Policy Template in this playbook is written specifically to satisfy ACSC Essential Eight Maturity Level 1 (ML-1) requirements for patch management. It covers the two-week patching timeline for internet-facing systems, the monthly patching cycle for non-internet-facing systems, and the vulnerability scanning requirements. A dedicated BONUS document maps every control in the playbook directly to the Essential Eight v3 patch management control set so you can demonstrate compliance with confidence.

This playbook is designed to work with or without an MSP. If you use an MSP, the Patch Management Policy Template gives you the contractual baseline to hold your provider accountable -- defining SLAs, patch approval windows, and reporting requirements that you can include in your service agreement. The Vendor Patch Tracker template helps you track what your MSP is patching and when, so you have independent visibility rather than relying entirely on provider reports. The Emergency Patch Protocol is critical even with an MSP, as zero-day response timelines require your internal sign-off authority to be clear before an incident occurs.

The Security Checklist Bundle is a broad 50+ item security audit tool -- it covers patch management as one item among many. This Patch Management Playbook goes ten levels deeper on that single domain. Where the checklist tells you 'patches should be applied within 30 days,' this playbook gives you the policy document, the priority matrix with CVSS-based SLA tiers, the step-by-step monthly runbook, the emergency 48-hour protocol, the vendor tracking spreadsheet, and the Essential Eight v3 control mapping. If you want to check whether you have a patching problem, use the checklist. If you want to fix it systematically, use this playbook.

Ad hoc patching -- where patches are applied when someone remembers, or when a vendor sends an alert -- consistently fails under pressure. The ACSC 2025 Annual Cyber Threat Report found that 60% of AU SMB breaches exploited unpatched vulnerabilities, the majority of which had patches available for more than 30 days. 'We patch regularly' is not the same as a documented, auditable process with defined SLAs, escalation paths, and emergency protocols. When a zero-day lands on a Friday afternoon, an informal process collapses. This playbook gives you the documented process that holds up under audit, insurance review, and incident investigation.

Three active threats in 2026 illustrate exactly why this playbook exists. CVE-2026-5281, a Chrome zero-day actively exploited in the wild, affected every business running Chrome on unpatched Windows endpoints -- a patch was available but the average AU SMB took 16+ days to deploy it. CVE-2026-24434, an axios npm supply chain vulnerability, hit development and operations teams running unpatched Node.js dependencies. The Progress ShareFile RCE vulnerability exploited internet-facing file-sharing infrastructure at businesses that had not applied critical patches within the ACSC-required two-week window. In each case, the patch existed. The process to apply it in time did not.

The playbook is written for IT managers and MSP operators who need to implement a formal process, but the policy template and priority matrix are designed so a compliance-conscious business owner can understand them, approve them, and use them to brief their IT team or MSP. The Monthly Patch Cycle Runbook uses plain language at each step and does not assume specialist knowledge beyond basic familiarity with software updates. If you have someone managing IT -- internal or external -- this playbook gives them the structure they need to work to a standard.