How to Build a Patch Management SOP for MSPs A well-defined patch management SOP is critical for maintaining security and operational consistency across managed environments. In this video, we'll break down how MSPs can build a structured patch management SOP for Windows, macOS, and third-party applications. Before we begin, be sure to subscribe to NinjaOne’s IT video hub and our YouTube channel for more tech content like this. Prerequisites to Keep in Mind Before implementing your SOP, make sure a few prerequisites are in place. Devices enrolled in an RMM, MDM, or centralized patching platform Administrator access to all managed endpoints Internet access to vendor update services PowerShell 5.1 or newer on Windows systems Terminal or shell access on macOS endpoints Optionally, you may also use tools like WSUS, JAMF, Munki, or a cross-platform solution such as NinjaOne. Step 1: Inventory and Classification of Patch Targets The first step is discovering every endpoint in your environment, then organizing them by operating system, version, and installed applications. On PowerShell, run this command: Step 2: Define Patch Categories and Frequency Next, you now must categorize patches and define how often each type of update is applied. Critical Security Updates should be deployed weekly across all endpoints. These patches address high-risk vulnerabilities and should always be treated as the top priority. Operating system. cumulative patches should be deployed monthly on both Windows and macOS devices. Feature updates are typically rolled out quarterly, and usually only after customer approval or when there’s a specific need. Third-Party Applications like browsers, Java, Zoom, and Adobe, should be patched weekly to reduce exposure from commonly targeted software. Step 3: Trigger Windows Updates There are several ways to trigger updates. For a one-time update, you can execute this command on PowerShell: Check out our blog for a full list of the methods you can try. Step 4: Apply macOS Updates This step ensures that Apple devices are updated reliably and securely. Just keep in mind, it’s a one-time update, not an automated process. Execute these commands in the Terminal: Step 5: Patch Third-party Apps Applications like browsers, Zoom, and Java are common attack targets and need to be patched on a regular basis. First, install Chocolatey. then run this command to allow the install: Use Chocolatey to update all applications in one step. Step 6: Patch Approval and Testing Workflow Testing and phased rollouts help make sure patches are stable before wide deployment. Start with a small test group about 5 to 10% of your devices. Deploy the patch, review the results, then roll it out in stages to the rest of the fleet. Track patch versions by rollout, wave and document any exceptions. Step 7: Rollback Strategy You need a quick, reliable way to roll back patches without disrupting users or losing data. Open a command prompt with administrator privileges, then run the following command. A solid patch management SOP keeps updates secure, consistent, and efficient across your environment. For more information, check out our official blog post on building a patch management SOP linked in the description below.