SP 800-40 Rev. 4Final2022

Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology

At a glanceTreats patching as routine preventive maintenance, a normal cost of running technology, rather than an optional security task. It recommends grouping systems, planning for routine and emergency patches, and handling systems that cannot be patched. A short, practical read for technology directors and the business officials who fund maintenance.

Reading level: Practitioner
Length: 28 pages · about 30 min for the key parts
Best for: Technology directors, IT staff and service partners, Business officials
CSF 2.0: Protect, Identify

Read it on NIST DOI 10.6028/NIST.SP.800-40r4 ↗

Browse the full library. 70 NIST publications summarized for school districts.

Key concepts

The guide explains why patching causes friction between operations and security and recommends an organization-wide strategy: inventory software and assets, define risk responses for routine, emergency and unpatchable cases, assign assets to maintenance groups with their own plans, choose useful metrics and consider maintenance during procurement.

How it is organized

Risk responses for software vulnerabilities and the vulnerability management life cycle
Recommendations: reduce patching disruption; inventory software and assets
Define risk response scenarios: routine, emergency (zero-day), unpatchable assets
Assign maintenance groups and plans; choose actionable metrics; consider maintenance in procurement

What a school district should take from it

Plan patch windows around the school calendar, with a faster path for actively exploited vulnerabilities.
Unsupported systems (old servers, building controllers) need isolation or replacement, not hope.
Ask vendors about update support before buying.

How to use it in your district

Group devices (staff laptops, student Chromebooks, servers, network gear, building systems) and give each a patch schedule.
Define an emergency process for known exploited vulnerabilities, using the Vulnerability alerts list.
Track two metrics: time to patch critical issues and the share of devices on supported versions.
Record unpatchable systems as risks with compensating controls and a replacement date.
Add 'security updates for the life of the contract' to procurement requirements.

Common misconceptions

Patching is an IT chore that leadership need not track.: Unpatched systems are a well-known route for attackers; patch status belongs in leadership reporting.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

PR.PSPlatform Security
ID.RARisk Assessment
ID.AMAsset Management

Tools in the program portal

Vulnerability alertsKnown exploited vulnerabilities that match your systems
School-year operations plannerSchedule recurring security work across the year
Risk registerRecord gaps leadership formally accepts, with controls and review dates
District operations toolkitLocal scripts for inventory and configuration checks

Related publications

SP 1800-25Ransomware: identify and protect
SP 800-30 Rev. 1Conducting risk assessments

Citation and source

SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology. National Institute of Standards and Technology. 2022. https://doi.org/10.6028/NIST.SP.800-40r4.

Replaces: SP 800-40 Rev. 3 (2013).

Topics: Patching and vulnerabilities. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.