# Control 2.10: Patch Management and System Updates

**Control ID:** 2.10<br>
**Pillar:** Management<br>
**Regulatory Reference:** GLBA 501(b), SOX 404, FINRA 4511, FINRA RN 24-09, FINRA Rule 3110, SEC 17a-4<br>
**Last UI Verified:** May 2026<br>
**Governance Levels:** Baseline / Recommended / Regulated<br>

---

## Objective

Implement structured patch management for AI agent infrastructure including Power Platform, Microsoft Copilot Studio, and dependent Azure services to maintain security posture, operational stability, and regulatory compliance.

---

## Why This Matters for FSI

- **GLBA 501(b):** Patch management protects customer information through vulnerability remediation
- **SOX 404:** Documented update processes provide internal control evidence
- **FINRA 4511, FINRA RN 24-09 / Rule 3110:** Patch records demonstrate system maintenance for books and records
- **SEC 17a-4:** System update documentation supports recordkeeping requirements

---

!!! tip "Automation Available"
    See [Message Center Monitor](https://github.com/judeper/FSI-AgentGov-Solutions/tree/main/message-center-monitor) in FSI-AgentGov-Solutions for monitoring M365 Message Center for platform changes affecting AI agents.


## Control Description

This control establishes patch management through:

1. **Update Monitoring** - Track Microsoft 365 Message Center and Azure Service Health
2. **Impact Assessment** - Evaluate updates for agent compatibility and business impact
3. **Testing Protocol** - Test updates in non-production before production deployment
4. **Deployment Windows** - Define maintenance windows aligned with business operations
5. **Rollback Procedures** - Document rollback plans for failed updates
6. **Documentation** - Maintain patch history for compliance evidence

---

## Key Configuration Points

- Subscribe to Microsoft 365 Message Center for Power Platform, Copilot Studio, and Microsoft 365 Copilot updates
- Configure Azure Service Health alerts (via Azure Monitor action groups) for the `Microsoft.PowerPlatform` and dependent resource providers
- Set the **Release Channel** on each Power Platform environment (Monthly for early validation, Semi-annual for production) at **PPAC > Environments > [env] > Settings > Product > Behavior**
- Establish a non-production environment that mirrors the production configuration and uses the **Monthly** release channel so platform changes surface there first
- Define maintenance windows aligned with the two annual Power Platform release waves (April and October) and document them by zone
- Maintain a pre/post-patch verification checklist tied to the agent's regression test suite
- Capture patch decisions, deployment outcomes, and rollback evidence in the change management system referenced by [Control 2.3](2.3-change-management-and-release-planning.md)

> **Implementation caveat:** Microsoft owns the underlying platform release cadence for Power Platform, Copilot Studio, and Microsoft 365 Copilot. Customers cannot defer or opt out of platform updates indefinitely; the controls above govern **awareness, validation, and response**, not suppression of vendor-driven changes.

---

## Zone-Specific Requirements

| Zone | Requirement | Rationale |
|------|-------------|-----------|
| **Zone 1** (Personal) | Default release channel acceptable; monthly review of relevant Message Center posts | Low blast radius; coordination overhead not justified |
| **Zone 2** (Team) | Validate breaking-change Message Center posts in a Monthly-channel sandbox; 48-hour validation window; documented deployment record | Shared agents warrant controlled validation before user-visible change |
| **Zone 3** (Enterprise) | Mandatory Monthly-channel sandbox + Semi-annual production channel; pre-deployment regression test; defined maintenance windows; rollback plan referenced in change ticket; SHA-256 evidence retained per SEC 17a-4(f) | Customer-facing or supervisory workflows require maximum stability and audit-defensible evidence |

---

## Roles & Responsibilities

| Role | Responsibility |
|------|----------------|
| Power Platform Admin | Monitor Message Center, configure release channels per environment, coordinate validation runs, capture evidence |
| AI Administrator | Track Microsoft 365 Copilot and Copilot Studio platform updates that affect agent behavior; coordinate with Power Platform Admin on dependent connector changes |
| AI Governance Lead | Approve patch schedules, sign off on maintenance windows for Zone 3, escalate breaking changes to CAB |
| Agent Owner | Assess business impact of upcoming changes, approve maintenance windows for owned agents, validate post-patch functionality |

---

## Related Controls

| Control | Relationship |
|---------|--------------|
| [2.3 - Change Management](2.3-change-management-and-release-planning.md) | Patches follow change management process |
| [2.4 - BC/DR](2.4-business-continuity-and-disaster-recovery.md) | Rollback procedures align with recovery plans |
| [2.9 - Performance Monitoring](2.9-agent-performance-monitoring-and-optimization.md) | Monitor performance pre/post patch |
| [1.7 - Audit Logging](../pillar-1-security/1.7-comprehensive-audit-logging-and-compliance.md) | Patch events captured in audit logs |

---

## Implementation Playbooks

!!! info "Step-by-Step Implementation"

    This control has detailed playbooks for implementation, automation, testing, and troubleshooting:

    - [Portal Walkthrough](../../playbooks/control-implementations/2.10/portal-walkthrough.md) — Step-by-step portal configuration
    - [PowerShell Setup](../../playbooks/control-implementations/2.10/powershell-setup.md) — Automation scripts
    - [Verification & Testing](../../playbooks/control-implementations/2.10/verification-testing.md) — Test cases and evidence collection
    - [Troubleshooting](../../playbooks/control-implementations/2.10/troubleshooting.md) — Common issues and resolutions

---

## Verification Criteria

Confirm control effectiveness by verifying:

1. Message Center email preferences include Power Platform, Copilot Studio, and Microsoft 365 Copilot service filters, and named recipients are current
2. Azure Service Health alert rules exist for `Microsoft.PowerPlatform` (and any dependent providers) with an active Azure Monitor action group routing to the operations team
3. The validation environment is set to **Monthly** release channel and the production environment is set to **Semi-annual** in PPAC > Environments > [env] > Settings > Product > Behavior
4. The most recent platform-driven change has a corresponding change record (per [Control 2.3](2.3-change-management-and-release-planning.md)) with impact assessment, validation results, and approver
5. The patch history log is retained with SHA-256 integrity evidence (Zone 3) or CSV export (Zone 1/2) for the look-back period required by your firm's record-retention policy under SEC 17a-4 / FINRA 4511

---

## Additional Resources

- [Microsoft Learn: Message Center overview](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/message-center?view=o365-worldwide)
- [Microsoft Learn: Service Communications API (Microsoft Graph)](https://learn.microsoft.com/en-us/graph/api/resources/service-communications-api-overview)
- [Microsoft Learn: Azure Service Health](https://learn.microsoft.com/en-us/azure/service-health/overview)
- [Microsoft Learn: Power Platform release channels](https://learn.microsoft.com/en-us/power-platform/admin/early-release)
- [Microsoft Learn: Power Platform 2026 release wave 1 plan](https://learn.microsoft.com/en-us/power-platform/release-plan/2026wave1/)
- [Microsoft Learn: Copilot Studio — what's new](https://learn.microsoft.com/en-us/microsoft-copilot-studio/whats-new)
- [Platform Change Governance Playbook](../../playbooks/advanced-implementations/platform-change-governance/index.md) — Structured workflow for Message Center change management

!!! tip "Deployable Solution: Message Center Monitor"
    For a ready-to-deploy Power Automate flow that polls Message Center and stores posts in Dataverse with Teams notifications, see the [Message Center Monitor Solution](https://github.com/judeper/FSI-AgentGov-Solutions/tree/main/message-center-monitor) in the FSI-AgentGov-Solutions companion repository.

---

*Updated: May 2026 | Version: v1.6.2 | UI Verification Status: Current*
