Attackers exploit known vulnerabilities within days of disclosure, especially on internet-facing systems. A risk based patching process prioritises exposed and actively exploited vulnerabilities first.
The short version
Start with what already exists. Most organisations have routines, documents or tools that cover part of the need, and connecting them is faster than building something new.
A quick check
- Patch internet-facing systems within days
- Track known exploited vulnerabilities
- Scan continuously, not once a quarter
Making it stick
Measure time to patch for critical findings and report it to management. Review the result after three months and adjust. What works in practice is worth more than what looks complete on paper.