Is Your Organization Prepared for Stricter Patch Deadlines?

admincybersecurity

Patching used to be an internal IT decision. It is becoming an obligation with a clock attached. US federal agencies already have hard deadlines for fixing exploited vulnerabilities, the payment card industry sets a one-month limit for critical patches, and regulators in healthcare, defense contracting and financial services are moving in the same direction. Organizations that still patch “when we get to it” are running out of room.

The driver is simple. Attackers now exploit known vulnerabilities within days of disclosure, and a large share of breaches start with a flaw that already had a fix. Regulators have concluded that timely patching is a baseline control, not a best practice. This article summarizes the deadlines that exist today, how they reach businesses that are not directly regulated, and how to build a patch program that meets the strictest one you are likely to face.

The deadlines that already exist

There is no single patching law, but several rules now set explicit or near-explicit timelines. The most relevant as of September 2025:

  • CISA Binding Operational Directive 22-01. Since November 2021, US federal civilian agencies must fix vulnerabilities in CISA’s Known Exploited Vulnerabilities (KEV) catalog by set due dates, generally two weeks for recently assigned CVEs. It binds only agencies, but the KEV catalog has become the de facto priority list for everyone.
  • PCI DSS 4.0. Requirement 6.3.3 requires critical security patches to be installed within one month of release for systems in scope for card data. The standard’s newer requirements became mandatory on March 31, 2025.
  • Proposed HIPAA Security Rule update. A proposed rule published by HHS on January 6, 2025 would require regulated health organizations to patch critical-risk vulnerabilities within 15 calendar days and high-risk ones within 30 days, where a patch is available.
  • CMMC and NIST SP 800-171. Defense contractors handling controlled unclassified information must identify and correct system flaws in a timely manner, and the CMMC program now requires that to be assessed rather than self-declared.
  • EU DORA and NIS2. The Digital Operational Resilience Act, which has applied to EU financial entities since January 17, 2025, and the NIS2 Directive both require documented vulnerability and patch management as part of broader ICT risk management.

The common thread is proof. Auditors increasingly ask not whether you have a patch policy, but how long it actually took you to close a specific critical vulnerability, and where the evidence is.

Why regulators are tightening the timelines

The window between disclosure and exploitation has collapsed. Mass scanning of the internet is cheap, and exploit code for high-profile flaws often appears within days. Edge devices such as VPNs, firewalls and file-transfer appliances have been hit repeatedly, and those attacks have disrupted hospitals, utilities and local governments. Once an unpatched system leads to an outage at critical infrastructure, patching stops being a technical preference and becomes a public-safety issue.

Small, overlooked software matters too. The WinRAR flaw CVE-2025-8088 was exploited against companies whose core systems were fully patched but whose archive utility was not. Regulators know this, which is why frameworks increasingly require a complete asset and software inventory, not just an operating system update schedule.

How the requirements reach you even if you are not regulated

A 40-person manufacturer or a regional accounting firm may never see a regulator. It will still feel these rules through its customers. Defense primes flow CMMC requirements down to subcontractors. Hospitals put patch commitments into business associate agreements. Banks send vendor security questionnaires asking for patch timelines in days. Cyber insurers ask the same question on renewal forms and can deny or reprice coverage based on the answer.

The practical effect is that the strictest requirement among your largest customers becomes your requirement. It is more efficient to build one program that meets a 15-to-30-day standard for critical and high-severity issues than to handle each contract differently.

Building a patch program that meets the deadlines

Faster patching is less about working harder and more about removing the delays built into the process. The steps that make the biggest difference:

  1. Know what you have. Maintain a live inventory of hardware, operating systems and installed software, including cloud servers and third-party utilities. You cannot meet a deadline for a system you do not know exists.
  2. Prioritize by real risk. Rank vulnerabilities by whether they are known to be exploited (KEV), whether the system is internet-facing, and how critical it is to the business, not just by CVSS score.
  3. Set written service levels. For example: KEV-listed and internet-facing critical issues within days, other critical issues within 15 days, high within 30, and the rest in the normal monthly cycle. Put them in policy so they can be audited.
  4. Automate deployment and testing. Use endpoint management tools to push patches in rings: a pilot group first, then everyone else. Automation removes the manual scheduling that turns days into weeks.
  5. Plan for systems you cannot patch. Legacy or vendor-controlled systems need documented compensating controls such as network isolation, restricted access and extra monitoring, plus a replacement plan.
  6. Record everything. Keep evidence of when a vulnerability was identified, when it was fixed and any approved exceptions. This is what auditors, customers and insurers ask to see.
  7. Train the team and assign owners. Every system needs a named owner responsible for its patch status, and the IT team needs to know which regulatory timelines apply to which systems.

The trade-off is operational risk: faster patching occasionally breaks an application. Staged rollouts and a tested rollback plan manage that risk far better than waiting. Our cybersecurity compliance and regulatory framework services help organizations map these requirements to a single, auditable patch program. For a closer look at the kinds of vulnerabilities driving the pressure, see Critical Zero-Days: Legacy Software and Widely-Used Platforms Under Siege.

Update (September 2026): The CMMC requirements began appearing in Defense Department contracts on November 10, 2025, making assessed flaw remediation a condition of winning work. The HIPAA Security Rule update, including its 15- and 30-day patch timelines, had still not been finalized as of this update, but many healthcare organizations are already building toward it.

Frequently asked questions

Does CISA’s KEV deadline apply to private companies?

Not directly. BOD 22-01 binds federal civilian agencies. But CISA urges every organization to use the KEV catalog to prioritize, and insurers, auditors and large customers increasingly treat KEV items as must-fix-now.

What if a vendor has not released a patch yet?

Deadlines generally run from when a fix is available. Until then, apply the vendor’s mitigations, reduce exposure (for example by restricting access to the affected service), increase monitoring, and document what you did and why.

Is a 30-day patch cycle still acceptable?

For routine updates, often yes. For critical vulnerabilities, especially those being actively exploited or on internet-facing systems, a monthly cycle is increasingly out of line with both regulatory expectations and attacker speed. Most organizations need a faster emergency track alongside the monthly cycle.

Getting ahead of the deadlines

Delana Technologies helps organizations build patch and vulnerability management programs that satisfy auditors, customers and insurers, from asset inventory and risk-based prioritization to automation and evidence collection. To review your patching against the timelines you face, call 239.414.5126 or contact us.

Sources: CISA Binding Operational Directive 22-01 (November 2021); PCI Security Standards Council, PCI DSS v4.0 Requirement 6.3.3; HHS Notice of Proposed Rulemaking on the HIPAA Security Rule (Federal Register, January 6, 2025) and status reporting as of September 2026; Department of Defense CMMC program and DFARS rule (2024–2025); EU Regulation 2022/2554 (DORA) and Directive 2022/2555 (NIS2).