building-patch-tuesday-response-process

Start with pre-Patch-Tuesday preparation, triage MSRC advisories on release day, categorize CVEs by CVSS and CISA KEV status, then deploy through rings: emergency zero-days in 24-48 hours, pilot group in days 2-7, production servers in days 7-14, and workstations in days 14-21.

Prioritize zero-days and CISA KEV-listed vulnerabilities first with a 24-48 hour SLA, then critical RCE flaws with CVSS 9.0 or higher within 3-5 days. Use EPSS scores above 0.7 or public exploit code to escalate patches, and handle medium severity items within 30 days.

You need the MSRC Update Guide for advisories, a vulnerability management platform such as Qualys VMDR, Rapid7, or Tenable, and deployment infrastructure like WSUS, SCCM/MECM, or Intune. A test environment mirroring production and a change management process are also required.

Systems with pending reboots remain vulnerable even after patch installation, and scan signatures may not be refreshed until T+1 after Patch Tuesday. Verify hosts actually rebooted and confirm the VM platform updated its detections before measuring compliance.

Re-scan the environment with updated vulnerability signatures after deployment and diff pre-patch and post-patch results rather than trusting deployment console status. Track failed patches, document exceptions with compensating controls, and report compliance rates per ring.