questionnaire asks how quickly we implement updates and patches

Patch management falls under vulnerability management, not separately

The question of how quickly updates and patches are rolled out is a sub-question within a broader theme: the process for identifying and remediating vulnerabilities. A customer asking this wants to know whether there is a structured process — not only whether an update is ever installed. In practice, it usually comes down to three things: is there a fixed cycle (weekly, monthly), is a distinction made based on severity (a critical vulnerability faster than a routine update), and is there an exception process for systems that cannot be patched immediately.

If there is no fixed process, "yet to be determined" is the honest answer — not because the subject is unimportant, but because a credible answer requires evidence: a patch policy, an overview of lead times per severity level, or a ticket system that records this. Without such documentation, any specific figure ("within 48 hours", "within 14 days") cannot be substantiated to the customer. Those who do have this process but have not documented it would do well to put it in writing first before it is confirmed as "yes". This is often linked to access control and asset management: without a current overview of which systems and devices exist, it is also impossible to establish whether everything is actually being patched.

Where this is based on: Article 21 paragraph 2 and Annex A

Patch management is not a separate legal term, but falls under the measures for vulnerability management mentioned in Article 21 paragraph 2 of Directive (EU) 2022/2555 (NIS2), where "handling of vulnerabilities" is one of the ten mandatory measures for entities falling under the directive. In ISO/IEC 27001, the same subject appears again in Annex A, under the control measures for technical vulnerability management. Both sources do not require a specific speed, but a process that demonstrably works. The Dutch Cybersecurity Act will expand on this later; it is expected to come into force on 15 August 2026.