Turn on automatic updates everywhere you can, install critical updates as soon as possible, and keep a short list of devices that cannot update so you can deal with them separately. CISA says many updates exist to fix security risks, so postponing them leaves known holes open.
Why updates matter
Many software updates are created to fix security risks. Once a fix is published, attackers can study what changed. The longer a device stays unpatched, the easier it is to attack with a method that is already public.
CISA advises installing all updates, especially for web browsers and antivirus software, and installing critical ones as soon as possible.
The policy in five lines
- Automatic updates are on for operating systems, browsers and apps on every organization device.
- Staff restart devices when asked, within a day.
- Phones and tablets used for work stay on supported versions.
- Internet-facing systems, such as the website and any remote access tools, are patched first.
- Devices that cannot be updated are listed, isolated or replaced.
Where to find the setting
CISA says to look in the device or app's security or software settings. On managed devices, your device management tool or mail platform admin console often has update policies you can apply to everyone.
What about the old equipment
Every school and charity has a printer, a door controller or a lab PC that nobody dares touch. List them. For each one, ask three questions: does it still receive updates, does it need internet access, and could it be replaced when funds allow?
If it cannot update and cannot be replaced, put it on its own network segment, restrict what can reach it and note the risk in writing.
Prioritize what faces the internet
CISA's ransomware guidance advises patching promptly with priority on internet-facing systems and known exploited vulnerabilities. The CISA known exploited vulnerabilities list is the most practical triage filter for a small team: if something on that list affects what you run, it goes first.
When updates break things
Sometimes an update breaks a tool. The answer is not to turn updates off. Test on one or two devices first for a few days, then roll out. Keep a rollback note.
The website and plugins
Your website may use a content management system, plugins and code libraries that nobody updates automatically. Put them on the monthly list. Our post on scanning a volunteer-built website for vulnerable dependencies covers it.
Quick check
Should every update be installed right away?
Critical security updates, yes. For large feature changes, a short test on a few devices first is reasonable. CISA says to install critical updates as soon as possible.
Sources
Last reviewed: 19 October 2026.
