Patch management for defense contractors
Patch management for defense contractors has two jobs: fix flaws fast, and prove it to an assessor. NIST SP 800-171 requirements 3.14.1 (correct system flaws) and 3.11.2 (scan for vulnerabilities) are worth 5 SPRS points each and may never go on a POA&M. Gardience patches Windows and Linux from one console on your own server, offline too, with approvals and a signed evidence pack.
- 5SPRS points each for 3.14.1 and 3.11.2, never on a POA&M
- 1,020servers patched in 13 minutes, one approved run
- 0internet connections needed for the offline install
- $10,000a year: Starter plus the CMMC add-on
Defense contractors that handle controlled unclassified information (CUI) are bound by DFARS 252.204-7012, which requires the 110 security requirements of NIST SP 800-171, and by CMMC Level 2, which scores them in the Supplier Performance Risk System (SPRS). Patching is in the middle of both: it is how flaws get fixed, and the record of it is what an assessor checks.
What do NIST SP 800-171 and CMMC Level 2 require for patching?
#| Requirement | What it asks | SPRS points | May go on a POA&M |
|---|---|---|---|
| 3.14.1 | Identify, report, and correct system flaws in a timely manner | 5 | No |
| 3.11.2 | Scan for vulnerabilities periodically and when new vulnerabilities are identified | 5 | No |
| 3.14.3 | Monitor system security alerts and advisories and take action in response | 5 | No |
| 3.11.3 | Remediate vulnerabilities in accordance with risk assessments | 1 | Yes |
| 3.4.3 | Track, review, approve or disapprove, and log changes to organizational systems | 1 | Yes |
| 3.3.1 | Create and retain system audit logs and records | 5 | No |
Points come from the DoD scoring in 32 CFR 170.24, and the POA&M rules from 32 CFR 170.21. Every requirement is on the CMMC Level 2 checklist.
How should a defense contractor prioritize patches?
#Start with what attackers are using. CISA's Known Exploited Vulnerabilities catalog lists the CVEs with evidence of real attacks, and since June 10, 2026 its directive BOD 26-04 gives federal agencies as little as three days for the most urgent ones. The directive binds federal civilian agencies, not contractors, but it is the clearest public signal of what to fix first. Then use EPSS, the likelihood a CVE is exploited soon, for everything else. See what the KEV list means for your servers.
What must the patching tool satisfy inside a CUI boundary?
#The tool that patches CUI machines is in the assessment scope too:
- Runs on your own server, or fully offline, with no cloud service in the path of CUI.
- Signed releases with a published key, and a software bill of materials for each image.
- No inbound ports on endpoints: the agent connects out to your server.
- Approvals and change windows, so every change is reviewed and logged (3.4.3).
- A tamper-evident audit log and evidence an assessor can check without trusting your screenshots.
How does Gardience handle patching for defense contractors?
#- Windows and Linux in one console. Every Windows Server from 2016 to 2025, Windows 10 and 11, RHEL, Oracle, Rocky, SUSE, Ubuntu, Debian, and Amazon Linux, each verified on real machines.
- Rings, windows, and two-person approval. Patch the pilot ring, verify, require a second person to approve, then patch the rest. Changes outside a group's window wait until it opens.
- Checked before it patches. Free disk, a healthy package database, reachable repositories, and a pending Windows restart are checked first; machines that are not ready are left out with the reason.
- CVEs ranked by CISA KEV and EPSS. Fix a CVE on only the machines that are exposed, with approval. Third-party Windows apps from the public winget catalog are updated and approved like any other patch.
- Offline too. Gardience installs from a signed bundle, Windows machines are scanned against Microsoft's offline update catalog, and a built-in update cache serves Debian, Ubuntu, Rocky, AlmaLinux, and EPEL packages.
- Evidence for the assessor. Every run, approval, and result is in the tamper-evident audit log and the signed evidence pack. Open CVEs go on the eMASS POA&M under SI-2 with CISA's due date when they are exploited.
On a test fleet of 1,000 Linux and 20 Windows servers, one run approved by a second person patched all 1,020 in 13 minutes; the method and logs are on the proof page.
How does patching fit the rest of CMMC Level 2?
#Patching is one part. Gardience covers all 110 requirements: it checks and fixes the technical ones on your machines, including the security baseline and DISA STIG scans, collects your records for the rest, and writes the System Security Plan and POA&M. A requirement marked met whose check starts failing goes back to not met, so the score you report stays true. See CMMC Level 2 software and what CMMC Level 2 costs.
Questions
#What does "timely" mean for 3.14.1?
#NIST SP 800-171 does not set a number of days. You define your timelines, usually by severity, in your System Security Plan and show that you meet them. CISA KEV due dates are a strong reference for the most urgent flaws.
Does CISA BOD 26-04 apply to defense contractors?
#Not directly. It binds federal civilian agencies. A contractor is covered only if its contract says so, but the KEV list is still the best public signal of what attackers are using.
Can we patch CUI machines with no internet connection?
#Yes. Gardience installs from a signed offline bundle, scans Windows machines against Microsoft's offline update catalog, and serves Linux packages from its update cache. See deployment options.
Does Gardience replace WSUS?
#Yes, for Windows and Linux together, on your own servers. See the WSUS alternative.
What does it cost?
#Starter is $6,000 a year for up to 250 machines, and the CMMC Level 2 add-on is $4,000 more. Team is $15,000 a year for up to 1,000 machines. All of it is free for 90 days on up to 25 machines.
Sources
#Checked November 7, 2026.
- DFARS 252.204-7012, safeguarding covered defense information.
- NIST SP 800-171 Rev. 2, requirements 3.3.1, 3.4.3, 3.11.2, 3.11.3, 3.14.1, and 3.14.3.
- 32 CFR 170.24 and 32 CFR 170.21, SPRS points and POA&M rules.
- CISA Known Exploited Vulnerabilities catalog and CISA directives.
Read more
- CISA KEV list: what it means for your servers
- Air-gapped patch management for Windows and Linux
- WSUS for Linux: one update cache for Debian, Ubuntu, Rocky and Alma
- WSUS deprecated: what Microsoft recommends and what it costs
- Windows Server 2016 end of support (Jan 12, 2027): what to do
Check your CMMC Level 2 score, then close the gaps
Score all 110 requirements free with the SPRS calculator. Gardience then checks and fixes the technical side on your Windows and Linux machines and keeps the evidence for the rest: Starter plus the CMMC add-on is $10,000 a year, free for 90 days.
Free SPRS score calculatorBuy Starter + CMMCCMMC Level 2 checklistBook a 15-minute CMMC walkthrough