---
title: "Essential Eight patch operating systems: timeframes | CCP"
description: "Essential Eight operating system patching: the deadlines at Maturity Level 1, 2 and 3 for workstations, servers, network devices, drivers and firmware."
url: "https://ccp.com.au/essential-eight/patch-operating-systems/"
datePublished: "2026-04-18"
dateModified: "2026-09-28"
author: "Computer Consultant Professionals"
---

# Essential Eight patch operating systems

## Windows, servers and firewalls, patched on a deadline.

Patching operating systems means applying security updates to workstations, servers and network devices on a deadline, and replacing versions the vendor no longer supports.

At a glance

Control

06 of 08 · Limit the impact

Stops

Attackers turning a foothold into full control

Typical tools

Windows Update for Business, Intune, a vulnerability scanner

Effort

Medium, ongoing

Changing ASD is replacing the Essential Eight with a new Essentials series. The work you do now still counts. [What’s changing ](https://ccp.com.au/essential-eight/essentials-series/)

## What is operating system patching?

### Where it stops an attack.

1.  The attack An attacker uses a Windows or firewall flaw to take full control of a device.
3.  Stopped here The update was applied on schedule, and unsupported versions were replaced.
5.  The result The foothold goes no further.

## Essential 8 patching timeframes for operating systems

### What changes at each level.

What changes ML1 ML2 ML3

Internet-facing servers and network devices 48 hours if critical or exploited, otherwise 2 weeks No change No change

Workstations, internal servers and network devices 1 month No change 48 hours if critical or exploited, otherwise 1 month

Drivers and firmware Not required Not required 48 hours if critical or exploited, otherwise 1 month

Asset discovery and scanning Discovery fortnightly. Scans daily for internet-facing, fortnightly for the rest No change Adds fortnightly scans of drivers and firmware

Operating system versions Unsupported versions replaced No change Latest or previous release only

Each level includes everything in the one before. A plain-English summary, not the requirement text. [ASD Essential Eight Maturity Model (November 2023)](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model)

[Check where you are with the free self-assessment](https://ccp.com.au/resources/essential-eight-checklist/)

## How to patch operating systems

### Protection first, disruption last.

1.  01

    #### Inventory every operating system

    Laptops, desktops, servers, virtual machines, firewalls, switches and access points.

2.  02

    #### Automate workstation updates

    Update rings in Intune: a pilot group first, then everyone, with restart deadlines.

3.  03

    #### Schedule server and network patching

    A regular maintenance window, plus an emergency process for exploited flaws.

4.  04

    #### Plan replacements early

    Track end-of-support dates and replace systems before they lapse.

[Related service: Managed IT support](https://ccp.com.au/services/managed-it/)

## Common operating system patching mistakes

### Where rollouts go wrong.

-   #### Restarts postponed forever

    Most updates don’t apply until the device restarts.

-   #### Ignoring firewall firmware

    Firewalls and VPN appliances are among the most attacked systems.

-   #### The old server that “still works”

    Unsupported servers are a standing risk, and an insurance problem.

## Operating system patching questions

### What clients ask before we start.

### How often should we patch Windows?

Microsoft releases security updates monthly. At Maturity Level 1, workstations and internal servers need them within a month. Internet-facing systems need them within two weeks, or 48 hours if a flaw is critical or exploited.

### Are Windows 10 devices still compliant?

Windows 10 reached end of support in October 2025. Unsupported operating systems need replacing, with Extended Security Updates only as a short-term bridge.

### Does this apply to Macs?

Yes. The control covers every operating system you run, including macOS.