I'm very familiar with the DoD's byzantine and prehistoric policies. You're absolutely right. And it's ironic, because changing their patch management strategy would provide better security. The DoD is stuck in a compliance world, rather that one in which they manage risk.