Patch Management
The software supplier will regularly provide interim software releases to resolve problems raised by any of its customers and eradicate 'bugs' found during investigation of those problems. These interim software releases are called patches and are often numerous, particularly if a new module has recently been introduced or the system is immature and, consequently, not as robust as a fully developed product. Suppliers often request customers to install patches soon after they have been released, and this can be particularly annoying because it demands very careful version control, is not always an easy or inexpensive exercise and the patches do not necessarily cover the parts of the software that the institution is using.
Suppliers also regularly provide new versions of the software called upgrades and these contain both bug fixes and enhancements to improve or extend the functionality of the system. Suppliers usually dictate that upgrades must be installed within 6 or 12 months of their release along with all patches previously issued since the last upgrade.
Patch management is the process of deploying those patches and upgrades into the live running system and maintaining them thereafter, and is usually the responsibility of TSP. Patch management can be onerous at times, but if it is done properly, it enables the institution to maintain operational efficiency and effectiveness, overcome security vulnerabilities, maintain the stability of the system and entitles the institution to receive full support from the supplier. Unfortunately, suppliers sometimes refuse to investigate problems if the latest patch has not been utilised, even though the patch may not be entirely relevant to the cause of the problem.
A number of products are available to assist organisations by automating the patch management tasks, but they can prove expensive and must be carefully evaluated to ensure that they provide the required facilities and services. It may be preferable for an institution to contract with the supplier for patch management and rely on them to select an appropriate product.
