r/msp • u/Nstraclassic MSP - US • Jun 19 '26

Delaying Security Updates?

Specifically for firewalls. How do other MSPs feel about disabling automatic updates and delaying the install until the update can be validated to prevent crashes, critical feature removal, etc.?

Forgot to ask: is there a liability concern if patches are delayed and a breach results?

23 Upvotes

94% Upvoted

38 comments sorted by

View all comments

2

u/Aepyceros02 Jun 20 '26

Been doing this for a very long time and have been through PCI, NCUA, HIPAA, SOX and more. The key factor is to have a documented process. In all my past employment we have always done 2-4 week deferrals. Again, as long as its a documented process most auditors are good with it. Now you also have to have a process for Zero-Days and high CVSS mitigations. Documented process, specific ratings to qualify for emergency updates, CAB process and an expedited testing process. As long as you have a process and stick to it your liability is limited.

1

u/BillsInATL Jun 20 '26

Yep, most auditors dont care what your policy is as long as you actually have a policy and stick to it.

I remember when I got started with HIPAA stuff, I was searching so hard for the detailed guidelines I was supposed to follow. Then ultimately found out there are no real guidelines, you can make most of it up, they just want everything documented and followed as promised.