Patch and vulnerability management: a practical routine for SA small businesses and councils

Most cyber incidents in small organisations don’t start with clever new attacks. They start with a known weakness that already had a fix: a firewall or VPN that missed its update, a website plugin left behind, a laptop that stopped updating months ago, or a server whose vendor support ended years ago. Patching is not glamorous, but it is one of the cheapest and most effective controls a South Australian small business, not-for-profit or council can have. It is also one of the first things cyber insurers, government buyers and auditors ask about. This guide sets out a practical patch and vulnerability routine you can run with a small team or an IT provider, based on the Australian Signals Directorate’s Essential Eight. It is general guidance; vendor support dates and product names change, so check current details for your own systems.

Patching and vulnerability management in plain words

• A patch is an update from the vendor that fixes a security weakness or bug. Some arrive automatically; others need someone to approve, schedule or install them.
• A vulnerability is a known weakness, usually given a CVE number and a severity rating by the vendor.
• Vulnerability management is the routine around patching: knowing what you have, finding what is missing, fixing the most dangerous gaps first, and recording what was done.
• End of support (or end of life) means the vendor no longer releases security fixes. From that point every newly discovered weakness stays open for good.

Step 1: know what you have

You can’t patch what you don’t know about. Start with a simple register, even a spreadsheet, that lists:

• Internet-facing systems: firewalls, VPNs and remote access gateways, routers, websites and their CMS and plugins, client portals, and any server reachable from the internet.
• Servers, on premises and in the cloud, with the operating system and version.
• Laptops, desktops and phones, ideally pulled automatically from your device management tool rather than typed in.
• Commonly targeted applications: Microsoft 365 and Office, web browsers and their extensions, email clients, PDF software and security products.
• Line-of-business software, such as accounting, rates, booking, CRM and practice management systems, and who supplies and updates each one.
• Network and other devices: switches, Wi-Fi access points, printers, NAS boxes, CCTV and building systems.

Record an owner, the vendor support end date and how each item is updated. Our guide to managing staff laptops and phones with Intune shows how device management keeps the laptop and phone part of this list accurate on its own.

Step 2: set patch timeframes by risk

Not everything needs patching the same day. The Essential Eight at Maturity Level One gives sensible, defensible targets that suit most small organisations:

• Internet-facing services and the operating systems of internet-facing servers and network devices: within 48 hours when the vendor rates the vulnerability critical or a working exploit exists, otherwise within two weeks.
• Office suites, web browsers and extensions, email clients, PDF software and security products: within two weeks.
• Operating systems of workstations and internal servers and network devices: within one month.
• Unsupported products: removed or replaced.

Higher maturity levels tighten these timeframes and add drivers and firmware. Write your targets into a one-page patch standard so staff, your IT provider and auditors all work to the same rules. Our Essential Eight guide for SA SMEs doing government work explains the maturity levels and how to evidence them without overclaiming.

Step 3: find what is missing, on a schedule

Automatic updates are a good start, but they fail silently more often than people expect: a laptop that is never restarted, an update that keeps failing, a device that dropped out of management. The Essential Eight expects regular checks with an up-to-date vulnerability scanner, and automated discovery of assets at least fortnightly:

• Scan internet-facing services and servers daily.
• Check office suites, browsers, email clients, PDF software and security products weekly.
• Check workstations and internal servers and network devices at least fortnightly.

For many small organisations this is covered by a combination of Microsoft Intune and Defender reports, the update dashboards in your cloud platform, and an external scan of your public IP addresses and website. Watch the Australian Cyber Security Centre’s alerts at cyber.gov.au and the US CISA Known Exploited Vulnerabilities catalogue; if something you run appears there, treat it as urgent.

Step 4: patch safely, without breaking the business

• Use rings. Send updates to a small pilot group first, such as IT and a few willing staff, then everyone else a few days later. Most problems show up in the pilot.
• Agree maintenance windows for servers and line-of-business systems, outside your busiest hours, and tell people in advance.
• Take a backup or snapshot first for servers and important applications, and know how to roll back. Our backup and disaster recovery guide covers restore testing.
• Force restarts after a grace period. Many updates are downloaded but never applied because a laptop is never restarted.
• Have an emergency path. When a critical flaw in your firewall or VPN is being actively exploited, patch within the 48-hour window, or take the service offline or apply the vendor’s workaround until you can.
• Don’t forget websites. CMS cores, plugins and themes are a common way in. See our guide to website care, updates and security.

Step 5: plan for end of support before it arrives

Unsupported software is the gap patching cannot close. Several Microsoft dates matter to SA organisations right now:

• Windows 10 reached end of support on 14 October 2025. Organisations can pay for Extended Security Updates year by year, up to October 2028, but ESU is a temporary bridge: it provides only critical and important security fixes, and the first commercial year ended on 13 October 2026, so any remaining Windows 10 PCs need year two cover or replacing now.
• Office 2016 and Office 2019, along with Exchange Server 2016 and 2019, reached end of support on 14 October 2025.
• Windows Server 2012 and 2012 R2: the final year of Extended Security Updates ended in October 2026.
• Windows Server 2016 reaches end of extended support on 12 January 2027. Our guide to moving servers and business applications to the cloud covers the options.

Keep support end dates in your register, review them every quarter, and put replacements into the budget a year ahead. For hardware that can’t run a supported operating system, plan the replacement rather than waiting for it to fail.

Step 6: record it, so you can prove it

Insurers, government buyers and auditors increasingly ask for evidence, not just a yes. Keep a monthly one-page report showing the share of devices fully patched, any overdue critical patches with a reason and a date, unsupported systems and the plan for each, and exceptions approved by a named manager. Our guide to cyber insurance questionnaires explains why accurate answers and kept evidence matter at claim time.

Extra points for councils and government suppliers

• SA Government security requirements and many council tenders ask suppliers about patching and Essential Eight maturity. A written patch standard and monthly reports are simple evidence. See our guide to the SA ISMF for ICT suppliers.
• Councils often run specialised systems for rates, libraries, depots and building control. Ask each vendor for their patching commitments and support end dates in writing.
• Where you rely on a managed IT provider, the contract should name the patch timeframes and the report you receive. See choosing a managed IT provider.

A practical 30-day plan

1. Week 1: build or refresh the register of systems, owners and support end dates. Flag anything internet-facing or unsupported.
2. Week 2: write a one-page patch standard using the Essential Eight timeframes, and set up update rings and forced restarts for laptops.
3. Week 3: run a scan of internet-facing systems and a device compliance report, then fix the critical gaps first, starting with firewalls, VPNs and websites.
4. Week 4: produce your first monthly report, agree exceptions with a manager, and schedule replacements for unsupported systems.

Questions to ask your IT provider

• What are your patch timeframes for critical, internet-facing and everyday updates, and are they in our agreement?
• How do you find devices and systems that have stopped updating?
• Which of our systems are unsupported or will be within 12 months?
• Do you patch firewalls, VPNs, network devices and our website, or only Windows?
• What will the monthly report show, and who signs off exceptions?

Talk to an Adelaide team

EITSAA provides managed IT and cyber security for SA small businesses, not-for-profits and councils, including patching, monitoring, Essential Eight uplift and end-of-support planning, with clear service levels and monthly reporting. Every engagement is quoted to your environment after a short onboarding assessment. Get a quote for managed IT and patching or call 0402 401 584, Monday to Friday, 9am to 5:30pm. See our managed IT and cyber security service.