Before the next urgent vulnerability, make sure you can answer five questions fast: what do we run, who owns it, how do we test a patch, what is our mitigation if there is no patch, and who can approve downtime. This checklist turns NIST SP 800-40 Rev 4 planning ideas into actions.
1. Inventory
- A current list of assets and the software on them.
- A software inventory for code you ship, such as an SBOM, so you can search by component and version.
- Owners recorded for every asset.
NIST says maintenance groups are built from software inventories and asset characteristics, so the list is the base for everything else.
2. Groups and plans
- Every asset is in a maintenance group. See how to define groups.
- Each group has a plan for routine patching, emergency patching, emergency mitigation and unpatchable cases.
- Time frames for beginning and ending each action are written down.
3. Roles and approvals
- A named incident owner for urgent patches.
- A person who can approve downtime for customer facing systems, with a backup.
- A contact list for vendors and for your own customers.
4. Testing path
- Canary assets identified per group. See canary patch rollouts.
- A pilot user list with a feedback route. See who to pick for a pilot.
- Written stop conditions.
- A rollback method for each platform.
5. Mitigations
- A pre-approved menu of mitigations per group. NIST says to have automated mechanisms to apply them quickly. See emergency mitigation.
- A way to change network rules fast and safely.
- A removal date process, so mitigations do not linger after the fix.
6. Unpatchable and exceptions
- A list of assets that cannot be patched, with approved long-term mitigations. See unpatchable assets.
- An exception register with owners and end dates. See the register.
7. Signals
- A source for exploitation evidence, such as a known exploited vulnerabilities list. See what is the CISA KEV catalog.
- A rule that turns evidence plus exposure into an emergency decision.
- Vendor advisories subscribed for your key products.
8. Metrics
- Time to patch tracked by asset importance and vulnerability importance. See patch metrics.
- Scan frequency and method good enough that the numbers are not understated. NIST warns that infrequent or passive scans skew results.
Run a drill
Pick a recent real advisory and ask the team to find every affected asset and decide the response within an hour. Note where it stalled. Fix that gap first. For software dependencies, a good drill is the exercise in find Log4j everywhere.
Safeguard provides asset discovery, SBOM and dependency scanning, reachability analysis and policies that can help with items 1, 7 and the code side of the drill. The free scan is at https://gold.safeguard.sh/scan.
Quick check
How long should this checklist take to set up?
The sources give no time. For most teams the inventory and group steps take the longest. Start with your most exposed systems.
Do small teams need all of it?
Scale it down. Two groups, one owner list and one written mitigation menu already help a lot.
Sources
Last reviewed: 19 October 2026.
