critical path security update policy