[Practice] Operating system and application services security patches should be installed expediently and in a manner consistent with change management procedures. [Category I] Required [Category II & III] 
Required