All devices and software must be updated/patched according to the following patch schedule, unless an exception has been made by OIT.
- Critical patches that pose a high risk to the University should be applied within 24 hours of release, unless an exception has been made by OIT.
- Other high-risk patches should be applied within 14 days of release.
- Other patches should be applied within 60 days of release.
Any system that cannot be patched based on the above schedule must document the business reason including a schedule for when patching will occur and communicate to all appropriate University leadership involved (OIT, Business Unit, Application Owners, etc.) for approval.