Two controls decide how bad a compromise becomes: how quickly you can remove a known vulnerability, and how confidently you can restore what was lost.
Patching without chaos
A patch cadence balances exposure against change risk.
- Critical, actively exploited: emergency change, as soon as safely possible.
- High severity: within days.
- Routine: a regular monthly window.
- End-of-life software: remove or isolate; there is no patch coming.
Track patch coverage by asset class, not as one number. A patched fleet of laptops does not help if the internet-facing VPN is six months behind.
Backups: RTO and RPO
- Recovery time objective (RTO): how quickly the service must be back.
- Recovery point objective (RPO): how much data loss is acceptable.
A daily backup with a 24-hour RPO is fine for a document share and unacceptable for a payment ledger. Write the numbers down before choosing the tool.
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.