Cybersecurity Awareness Month, week 3: Check software updates across your business
During Cybersecurity Awareness Month, we are focusing on one practical action each week that small businesses can take to improve their security.
In Week 1, we focused on multifactor authentication for business email. In Week 2, we looked at testing whether an important file could be restored from backup.
This week, the task is to check software updates across your business. Find out which systems are missing security updates, then make sure someone is responsible for getting those updates completed.
Why software updates matter
When an update notification appears during a busy workday, it is easy to postpone it. You may have a client waiting, a deadline approaching, or several programs open that you do not want to close.
Some updates fix security vulnerabilities, which are weaknesses an attacker could use to compromise a device or access information. Leaving those updates uninstalled leaves the weaknesses unresolved. CISA recommends installing updates promptly and enabling automatic updates to help keep devices protected.
For a small business, that makes updates part of maintaining the systems that hold client records and support daily work.
This week's action
Ask whoever manages your technology for a current update review covering the devices and software your business uses. If you handle IT yourself, start with a simple list and work through it.
Include:
- Office computers, laptops used at home, and spare devices.
- Operating systems, web browsers, PDF readers, email applications, and security software.
- Accounting, tax, scheduling, or other software your business depends on.
- Servers, firewalls, routers, and equipment used for remote access.
Network equipment also runs software, often called firmware. Include it in the review even though employees may never see an update notification for it.
For each system, record when it was checked, whether security updates are missing, and who will handle anything outstanding. An IT provider can supply this through a management report. For a small office, a spreadsheet can also give you a useful starting point.
The review should leave you with a list of specific items to resolve.
Confirm that updates finished
A setting that allows automatic updates is useful, but you still need to check the result.
Microsoft notes that some Windows updates require a restart to finish installing. If a device is waiting for that restart, schedule a time to save work, close applications, and complete it. Afterward, check the update status again.
Record failed installations and paused updates so someone can investigate them. Include laptops that have been turned off or away from the office, and check those devices when they are available.
Ask for separate confirmation that business applications are covered by the update process. A completed operating system update does not establish that every application has been checked.
NIST describes patch management as a process that includes verifying installation. That verification is the part you want your review to capture.
Give unresolved items an owner and a date
Some updates need coordination. An accounting application may require a compatibility check, and restarting a server may interrupt access to shared files.
For systems that support daily operations, have your IT provider review the vendor's instructions, confirm backups are available, and arrange an appropriate maintenance window. After the work, check that employees can still use the functions they depend on.
NIST's patching guidance covers both routine and emergency updates. Ask your provider which findings need urgent attention and which can follow the normal maintenance schedule. A serious vulnerability being actively exploited may require action before the next scheduled visit.
If an update must wait, write down why, who owns the follow-up, and when it will be revisited. That gives you something concrete to check at the next review.
Check whether the software still receives security updates
An older program can continue opening files after its vendor stops supporting it. During this review, confirm that the versions you rely on still receive security fixes.
CISA recommends replacing unsupported hardware and software. If your business depends on an unsupported system, ask your IT provider and the software vendor for a transition plan. Record the replacement or upgrade needed, any compatibility concerns, and the person responsible for moving it forward.
What to have by the end of the week
Keep a short record showing:
- Which devices and applications were checked.
- Which updates were completed and verified.
- Which items remain open, with an owner and target date.
- Which unsupported systems need a replacement or upgrade plan.
Use that record at your next IT check-in. Set a recurring review so the work continues after Cybersecurity Awareness Month.
Start with this question for your IT provider:
"Can you show me which of our devices and applications are missing security updates, which are no longer supported, and when the outstanding items will be addressed?"
Sources
- Microsoft, Keep your PC up to date with active hours: restarts to complete Windows updates.
- NIST, Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology: verifying patch installation.
- NIST, Improving Enterprise Patching for General IT Systems: routine and emergency patching.
- CISA, Update Business Software: timely patching, automatic updates, and replacing unsupported hardware and software.