Security hygiene
Build a patch review routine one IT generalist can sustain
A monthly patch routine for a small IT team: a trusted inventory, risk tiers, a test ring, device-level evidence, dated exceptions, and a report leadership can use.
Start with repeatable IT work that has a clear owner, clear access limits, and a review cadence. Keep risky technical decisions with the manager or provider who owns the system.
Delegation playbook
On this pageJump to section
Patch management fails in small companies for a boring reason: nobody owns the whole loop. Someone approves updates, someone else installs them, and nobody checks whether the install actually happened. A single IT generalist can run a credible routine if the scope is small, the evidence is simple, and exceptions have an expiry date. The routine should fit a normal week, not a security programme that only exists in a slide deck. Consistency matters more than a perfect score in any one month.
Start with an inventory you trust
You cannot patch devices you cannot list. Export the managed endpoints from the device management tool and compare them with the asset register. Add the servers, network appliances, and cloud workloads that sit outside the endpoint tool. Reconcile the two lists before you set a coverage target. The reconciliation will usually reveal a handful of devices that nobody has claimed.
Record the owner, the operating system, and the patch channel for each asset. A laptop that is offline for months is a different problem from a server that has no maintenance window. Mark the devices that cannot be updated automatically and explain why. The inventory should be short enough to review in one sitting. If it is not, split it by environment and review one environment at a time.
Assign risk tiers that change the schedule
Group assets by what happens if they are compromised, not by how new they are. Domain controllers, finance systems, and internet-facing servers belong in the highest tier. Standard laptops and test machines can follow a slower cadence. The tier decides the approval path and the maximum time an update may wait. A tier that does not change anyone's behaviour is only a label.
Use vendor severity and known exploitation as inputs, but do not let a label replace judgment. A medium-severity flaw on an internet-facing service can matter more than a high-severity flaw on an isolated lab machine. Write the reasoning beside the tier so the next person can follow it. Review the tiers when a new system joins the estate. The review should take minutes, not a committee meeting.
Set a monthly window and a weekly check
Pick a recurring maintenance window that the business can tolerate. Publish it in advance and include the systems that will be unavailable. Run a weekly check for urgent updates outside the window, with a named person who can approve an emergency change. The schedule should be predictable enough that users stop asking whether this month is happening. A calendar entry with an owner is more reliable than a reminder in someone's head.
Separate detection from installation so the process does not hide failures. The weekly check confirms that scans ran and that new updates are visible. The monthly window installs them and records the result. If a scan did not run, the week is not complete even when no updates appear. The check should take a few minutes and leave a timestamped note.
Use a small test ring before the estate
Choose a few representative devices for the first installation. Include one standard laptop, one machine with the most common line-of-business application, and one server if the update affects servers. Confirm that the business application still opens and that the user can sign in. A test ring is not a guarantee, but it catches the obvious conflicts before everyone is affected. Keep the test group small enough to check in under an hour.
Keep the test ring stable so comparisons mean something. If the ring changes every month, you cannot tell whether a failure came from the update or the device. Record the application checks and the time they were performed. Promote the update only after the checks pass or the exception is accepted. If a test device fails, pause the rollout and investigate before expanding it.
Record evidence per device
For each device, capture the patch identifier, the installation time, and the result. A dashboard that shows ninety percent compliance is not evidence for the one device that matters. Store the output with the asset name and the person who checked it. The record should answer whether the update was installed, not whether it was offered. A screenshot of the device status is often enough when it includes the hostname and date.
Treat pending reboot, failed install, and unsupported hardware as separate states. Each state needs a different next action and a different owner. Do not collapse them into a single failed count, because that hides the work required. A short status list makes the monthly report honest. The list should also show the last time the device checked in and whether the user has restarted it.
Manage exceptions with an expiry date
Some devices cannot take an update because of a vendor constraint or a clinical or industrial application. Record the reason, the risk owner, and the date the exception will be reviewed. Set a reminder before the expiry so it does not become permanent by neglect. An exception without an end date is an accepted vulnerability. The review should ask whether the constraint still exists, not just whether the device is still in use.
Compensating controls can reduce risk while the exception is open. Network segmentation, restricted sign-in, and extra monitoring are common examples. Write down which control is in place and who verifies it. Review the control at the same time as the exception, not only when an audit asks. If the control cannot be verified, the exception should be treated as unmitigated.
Report in a way leadership can use
Report coverage, overdue items, exceptions, and the number of devices with unknown status. Add one sentence about the business impact of the overdue items. Avoid a single percentage that hides the difference between a test laptop and a public server. The report should support a decision about resources or risk. A reader should be able to see what changed since the previous month without opening a second document.
Keep the previous three reports beside the current one so the trend is visible. A flat month after a bad month may mean the backlog is stable, not fixed. Name the one change that would improve coverage most, such as retiring an old server or funding a second maintenance window. Then ask for that change explicitly. A report without a request is only a status update.
Sources and next step
Use the CISA Cross-Sector Cybersecurity Performance Goals and the NIST Cybersecurity Framework as primary references for identity, asset, logging, and recovery practices. Apply your own policies, contracts, and system documentation to the workflow. Compare this guide with the IT change request process and the remote helpdesk workflow before changing a live process.
Keep requests, approvals, and evidence in systems the business already controls. If the coordination is recurring and your technical owner can define the boundaries, review the IT virtual assistant service areas and contact ITVirtualAssistant to discuss a limited pilot.
Operating brief
What this guide should help you decide
Routine intake, status updates, records, screenshots, and documentation upkeep.
Approvals, risky system changes, security decisions, and final technical judgment.
How to use this guide
Use this page to decide what an IT virtual assistant should handle first. If the task is recurring, documented, and easy to review, it is usually a better first delegation candidate than work that requires live technical judgment.
Treat the article as an operating brief, not just a topic overview. The goal is to turn loose IT work into a named workflow with inputs, outputs, permissions, review cadence, and a handoff rule that protects the business while reducing manager load.
Workflow
Recommended operating workflow
Define the request
Write what build a patch review routine one it generalist can sustain means in your company, where requests enter, and what finished work looks like.
Limit the access
Give the assistant only the tool permissions needed for intake, records, status updates, or documentation.
Run a pilot
Use a two-week sample period so the manager can review accuracy before expanding the workflow.
Review patterns
Summarize repeat issues, blocked requests, and escalation volume so the technical owner can improve the process.
Decision rules
| Question | VA fit signal | Escalate when |
|---|---|---|
| Is the work repeatable? | The same request appears weekly and can be described in steps. | The request changes business policy or system design. |
| Can quality be reviewed? | The manager can inspect the output without redoing the work. | Only a senior technical person can judge correctness. |
| Is access contained? | The assistant can work with read-only or role-limited access. | Admin rights, customer data, or security settings are involved. |
Delegation checklist
- Write the intake source, expected output, and manager review cadence.
- Confirm the assistant has only the permissions needed for the workflow.
- List the events that require escalation before work continues.
- Track examples for two weeks before changing the workflow.
- Save examples of good and bad outputs so the assistant has concrete references.
- Review the workflow monthly and remove permissions that are no longer needed.
Example first-week agenda
Day one should cover the workflow owner, tools, allowed actions, forbidden actions, and escalation language. By the end of week one, the assistant should have produced a small sample of completed work, a list of unclear requests, and a manager-reviewed improvement note.
What to review before delegating
Confirm the owner, access level, review cadence, and escalation path before assigning any recurring IT workflow to a remote assistant.
What should an IT virtual assistant handle first?
Start with repeatable, reviewable work such as ticket summaries, account records, documentation updates, and checklist follow up.
Get free IT support review