Hope you are doing well. I need to discuss about the process for patch management especially for the critical servers. I have read that typically such process should be like analyze the patch’s fix i.e. what bug is fixed in the patch is it related to security or system? Then taking approval and verification and testing the patch in a testing environment, , making a back off plan in case of any issue arise with new patch installed etc.
But small business company where there is no testing environment is present what should be the best practice for deploying these patches? How can we safely deploy these patches as there is no actual testing environment present and what should be done in case of a major security fix? Should that be deployed immediately or take some time even deploying such critical patches.