Patch management is the process of acquiring, testing, and deploying software updates that close security vulnerabilities and fix functional bugs. Vendors ship patches once a flaw is confirmed, and the window between a public disclosure and a working exploit is often measured in days, so the speed of your process matters as much as its thoroughness.
A working program tracks new releases, judges how urgent and applicable each one is, tests in a staging environment, schedules a deployment window, then confirms the fix actually installed. The hard part is rarely the install. It is the exceptions: legacy systems that break under a patch, or medical and industrial devices you cannot reboot on demand. Those need compensating controls, network isolation, or tighter monitoring, and every exception should carry a documented risk decision rather than quietly lingering.
How is patch management tested on the CISSP?
Patch management sits in Domain 7: Security Operations as a core operational control. Expect questions on prioritizing by severity and real-world exploitability, why testing precedes deployment, and how to protect a system that genuinely cannot be patched. CISA maintains the Known Exploited Vulnerabilities Catalog for prioritization.
Related terms: Vulnerability Assessment, Change Management