Whats the best way to patch systems in a PCI environment