Emergency out-of-band patch process

Overview

Zero-days or in-the-wild exploits need faster lanes than monthly maintenance—without bypassing approvals entirely.

Triggers

CISA KEV additions, vendor active exploitation bulletins, insurance mandates.

Fast path

1. Security committee virtual huddle (15 min).
2. Pilot patch to Canary group; monitor 2–4 hours unless catastrophically urgent.
3. Broad deploy with extended monitoring window.

Documentation

Post-incident note: rationale, timing, defects encountered.

Comms

Executive SMS template: “We’re deploying critical security updates tonight due to active threat X; expected brief reboot Y.”