Patch & Vulnerability Prioritisation Worksheet

Use this worksheet monthly to prioritise updates, track exceptions, and create evidence that patching is being managed—not guessed. Start with critical systems, internet-facing services, remote access tools, finance/admin devices, backups, and identity platforms.

Part A: Asset and Exposure Register

Asset / Platform	Type	Internet-facing?	Business Criticality
Firewall / VPN	Network	Yes/No	High
Microsoft 365 / Google Workspace	SaaS / Identity	Yes	High
Finance/Admin Devices	Endpoint	No	High
Backup Platform	Recovery	Yes/No	High
Line-of-business App	Application	Yes/No	Medium/High

Part B: Prioritisation Matrix

Exploitability	Exposure	Business Impact	Change Risk	Priority
Low/Med/High	Low/Med/High	Low/Med/High	Low/Med/High	P1/P2/P3
Low/Med/High	Low/Med/High	Low/Med/High	Low/Med/High	P1/P2/P3
Low/Med/High	Low/Med/High	Low/Med/High	Low/Med/High	P1/P2/P3

Part C: Monthly Patch Review

Metric	This Month	Last Month	Trend	Action
Endpoint patch coverage			Improving / Stable / Worse
Server patch coverage			Improving / Stable / Worse
High-risk unresolved items			Improving / Stable / Worse
Repeated patch failures			Improving / Stable / Worse
Open exceptions			Improving / Stable / Worse

Part D: Exception Register

System / App	Reason for Exception	Risk Accepted By	Compensating Control	Review Date	Status
					Open / Closed
					Open / Closed

Part E: This Month’s Actions

1) ____________________________________________
2) ____________________________________________
3) ____________________________________________

Tip: Prioritise internet-facing systems and privileged-user devices before routine low-risk updates. Keep evidence short, readable, and decision-focused.

👉 Book your free consultation today
📧 hello@virtusgroup.biz
🌐 virtusgroup.co.nz
📞 0800 847 887 (VIRTUS)