Category
Compliance and RegulationsUpdated October 2026 to our current guidance. The original reporting date is unchanged.
If you are a subcontractor on federal work, the question usually arrives on a prime contractor’s security questionnaire: how do you keep your computers up to date, and how fast do critical updates go in? The prime asks because you are in its supply chain. If your machines go down, its deliverables slip too.
Keeping systems patched feels like a job that never ends. For contractors handling Controlled Unclassified Information (CUI), NIST SP 800-171 requires it, and since the CMMC rule took effect on November 10, 2025, Defense Department contracts can require you to show it. The routine itself does not have to be complicated.
Tracking updates across dozens or hundreds of systems is real work. The right tools cut most of it.
Microsoft’s own tools, Intune and WSUS, scan for, download, and deploy Windows updates across your computers. They handle Windows and Microsoft software.
Windows Update never touches third-party software. Your PDF reader, file compression tool, browsers, remote-access program, and the engineering or accounting apps your work depends on each update on their own schedule, or not at all. Nobody did anything wrong. That is where Windows Update’s job ends. So your routine needs a second piece: a patch tool that also covers third-party programs on Windows, macOS, and Linux, or a person who is responsible for them.
A central patch console lets you:
Without a system, things slip. Here is how to keep track.
You can’t update what you don’t know is there. Track:
An inventory tool or a well-kept spreadsheet works for a smaller shop.
Before you build it, try a guess. How many programs are on one of your computers? Write the number down, then count.
Count What’s on Your Computers → See how many programs each Windows PC has, how many are current, and how many need updating. No credit card needed. The scan is on us. If you want step-by-step instructions afterward, that’s a paid report, and you’ll see the price before you decide.
If the count is higher than your guess, or more programs need updating than you expected, that is common. You don’t have to be able to do this. We’ll do it with you. If you run it and never speak to us again, that’s a fine outcome.
Set up recurring checks to catch gaps:
Nobody wants a forced restart the afternoon a job is due to ship. Planning ahead keeps the business running.
Test before an update reaches the machines the business depends on:
Sometimes an update causes trouble. Here is how to hear about problems early.
Not every update is equally pressing:
Patch management comes down to a repeatable routine and records that show you follow it. For CUI environments, NIST SP 800-171 and CMMC require consistent patching. The prime contractor’s questionnaire asks the same thing in plainer words. Know what is installed, cover the programs Windows Update doesn’t, keep the work running while you do it, and write it down.
Join the owners who get Craig's Insider Notes every week.
Tagged with: