18 controls · Public CSV · No signup

A patch exception needs an expiry, not a hiding place.

Use this review and closure template when a Windows update cannot follow the normal deployment schedule. It turns a deferral into a scoped, approved, monitored, and time-bound risk record.

Download the CSV Review the patch policy Triage the failure before approving an exception Keep exclusions visible in compliance Compare RMM with patch management Use the patch checklist Use the Data Package

1. Request and evidence

Name the affected update and scope, document why normal deployment is blocked, and attach the scan, error, compatibility, or change evidence behind the request.

2. Scope and risk

Reconcile every affected endpoint and identify internet-facing, privileged, executive, regulated, or otherwise high-impact systems before approval.

3. Compensation and approval

Define temporary controls, verify that they cover the full scope, and obtain approval from a named risk owner and the required customer or internal authority.

4. Monitoring and expiry

Watch for scope drift, exploitation evidence, failed controls, and approaching expiry. Set the next review date and reject open-ended waivers.

5. Retest and closure

Use a safe pilot and explicit success criteria, reconcile the post-action scan, remove temporary controls when appropriate, and close the record with evidence.