In many small companies, updates are handled by whoever is annoyed enough. A laptop asks to restart for the fifth week in a row and is ignored. The accounting program runs a version from three years ago because "it works". Then one day a browser stops opening a supplier portal, or a security fix that was available for months turns out to matter.
Updates feel like a risk to a busy team: something might stop working. Not updating is also a risk, and it grows quietly. This article describes a routine that fits on one page and needs no special software: one owner, a short list, a fixed day, a test on one machine and a way back.
Why postponing costs more
Software vendors release patches to fix security flaws and bugs. Once a fix is public, so is the information about the flaw, and attackers read the same release notes as you do. The US cybersecurity agency CISA lists regular updates as one of the basic habits for staying safe, and recommends turning on automatic updates where you can (see CISA, Update software). The UK National Cyber Security Centre gives similar guidance for company devices (see NCSC, Keeping devices and software up to date).
There is a second cost that is easier to see. If you skip updates for a year, the next one is a big jump. Several things change at once, and when something breaks nobody knows which change caused it. Small, regular updates are easier to test and easier to undo.
Step 1: name one owner
Pick one person who is responsible for updates. This does not have to be an IT specialist; in a company of ten people it is often the office manager or the person who already looks after the Wi-Fi. What matters is that the name is written down and that the person knows it is part of their job, with time set aside.
Also name a stand-in for holidays and sick days. If you work with an outside IT provider, the owner is still someone inside the company who checks that the provider does what was agreed.
Step 2: write the short list
You do not need a full asset register. Make a one-page list of what must stay up to date:
- Operating systems on laptops, desktops and any server or network storage.
- Browsers and office software, because they handle files and links from outside.
- Key business tools: accounting, order handling, the internal tool someone built for you, the website and its plugins.
- Network equipment: the router, firewall and Wi-Fi access points, which are often forgotten for years.
- Phones that read company email.
For each line note who uses it, whether updates are automatic and who updates it if they are not. If you already keep a list of devices, as described in a company device inventory for laptops and phones, extend it with a column for "last updated". Apps and accounts are a separate topic, covered in an annual clean-up day for accounts, licences and leftovers.
Step 3: choose a fixed day
Pick one day a month, for example the second Thursday, and put it in the shared calendar. Some vendors already work on a schedule. Microsoft, for example, releases its regular security updates on the second Tuesday of the month, known as Patch Tuesday (see Patch Tuesday). A routine that starts a few days after that date means the fixes are fresh but have already been used by many other companies.
Choose a time when a restart is not a problem, such as early in the morning or after lunch on a quiet day. Tell people in advance: save your work and do not postpone the restart.
Two rules keep the routine realistic:
- Urgent security fixes do not wait for the monthly day. If a vendor or your IT provider says a flaw is being actively exploited, the owner applies the fix within a few days.
- Automatic updates are fine for low-risk items, such as browsers and phone apps. Keep manual control for things that other work depends on, such as the accounting system or an internal tool.
Step 4: try it on one machine first
Before you update everyone, update one machine that belongs to a person who is tolerant of surprises and uses the main tools. Use it for a day or two. Check a short list of things that must work:
- the tool the company cannot work without, for example accounting or ordering,
- printing and scanning,
- the VPN or remote access, if you use one,
- logging in to the main web services,
- opening and saving the files people actually use.
If all is well, roll out to the rest. If something breaks, you have found it with one person affected rather than twelve, and you can decide whether to wait for a fix or work around it. A change to an internal tool deserves the same treatment as a vendor update; when you build such a tool yourself, a short test with real cases before staff see it is the same idea.
Step 5: know the way back
Do not start an update unless you know how to undo it. For each important system that means one of these:
- a recent backup that you have actually tried to restore at least once,
- a restore point or snapshot taken just before the update, which many operating systems and virtual servers support,
- the previous installer or version number of the application, saved in a known place,
- for a website or custom tool, the previous release and the steps to switch back to it.
Write one or two sentences next to each item on the list: "Accounting: copy of the data folder before the update; previous installer on the shared drive". If a vendor allows you to defer a feature update for a few weeks, use that option on business-critical machines. The way back is rarely needed, but the day you need it, you will not have time to look for it.
Step 6: keep a short log
After the update day, the owner adds a few lines to a shared note or spreadsheet: date, what was updated, which machines, any problems and what was done about them. It takes five minutes. It answers the question that always appears later: "When did this start happening?"
The same log shows what is outstanding. If a laptop was away on a trip and missed the day, it is on the list for next week. If a device cannot receive updates any more because the vendor has ended support, the log is where you notice, and where you plan its replacement. Software that no longer gets security fixes is a risk that grows every month.
Common mistakes
- No owner. Everyone assumes someone else did it.
- Postponing the restart. The update is downloaded but not applied. Ask people to restart at the end of the day at the latest.
- Updating everything at once on the busiest day. Choose a quiet day and start with one machine.
- Forgetting the router and other devices. They are rarely touched, and they sit at the edge of your network.
- Having a backup nobody has tested. A backup you have never restored is a hope, not a plan.
- Ignoring unsupported software. If the vendor no longer issues fixes, plan a replacement rather than hoping.
A first step
This week, write down who owns updates and who covers for them, and list the five systems the company cannot work without. Check when each was last updated. Then book the monthly day in the calendar. That is enough for a start; the rest of the routine can follow over the next month.
If your key tool is a custom or internal application and nobody is sure how to update or restore it safely, that is worth fixing first. Our team can help with a short review of how it is updated and how to go back; see our custom software service.
