Device patching involves installing the latest firmware and software releases for your ICS devices on a consistent basis and within a reasonable time after such updates get released.

Check if your ICS vendor offers cryptographically signed firmware versions for their devices. As an example of this, Rockwell Automation decided to start signing all their modules' firmware images for their ControlLogix platform, starting with revision 20 of their ControlLogix product line. What this means is that the controller will refuse to accept flashing to a firmware image unless it has a valid digital signature. This feature prevents installing and running tampered-with firmware.

New firmware images, OSes, and patches to ICS devices should be tested in a testing or development environment. Making sure the new revisions work with your specific setup before deploying to a production network can save you from a lot of headache and downtime.