Which of the following is part of a risk-based patching cadence for OT systems?

• A. Apply patches immediately to all systems without testing.
• B. Schedule patches during maintenance windows to minimize downtime.
• C. Prioritize patches by risk score, test patches first, and document approvals and results.
• D. Ignore patch documentation and approvals.

Answer: (C)

In OT patch management, the emphasis is on making security updates without compromising safety, stability, or availability. Prioritizing patches by risk score means evaluating how severe the vulnerability is, how likely it is to be exploited, which assets are most critical, and how exposed they are, so you address the most important issues first. Testing patches before deployment helps you catch compatibility or safety problems with OT devices like PLCs, HMIs, and SCADA components, preventing unintended outages or process disturbances. Documenting approvals and results creates a clear change record for governance, audits, and the ability to roll back if a patch causes issues. Together, these steps form a controlled, responsive cadence that improves security while preserving safe operation and uptime. Options that push patches out immediately without testing, rely solely on maintenance windows without prioritization, or ignore documentation and approvals undermine safety, reliability, and governance.