Systematically following ICS advisories sounds simpler than it is. After doing so structurally for a year for several OT environments in the energy sector, three lessons have emerged that are more broadly applicable.
Lesson 1: volume is not a good measure of risk
The number of advisories per week says little about the actual risk for a specific organisation. Many advisories concern products that are not used in your own environment, or functions that are not actively configured. Without a current asset inventory, following advisories mainly leads to noise, not to usable prioritisation.
Lesson 2: revisions often contain the most important information
An initial publication of an advisory regularly contains no patch information yet — that follows in a later revision ("Update A" or "Update B"). Anyone who only looks at the initial publication and does not actively track revisions often misses exactly the moment at which a concrete measure becomes available. This is one of the reasons why this platform explicitly shows revision history on the ICS Advisories page.
Lesson 3: industrial relevance requires more than keyword searching
Simply searching on product names produces false positives and missed hits: vendors do not always use consistent product names, and the same underlying component is sometimes published under a model number, and at other times under a brand name. Effective triage requires a combination of CPE matching, vendor information and human verification — none of the three is sufficient on its own.
What this means for setting up a process
The most important conclusion may be that following advisories is not an end in itself, but an input for a broader process: from signalling, via industrial relevance assessment, to an explicit treatment decision. See also this knowledge base article for a worked-out step-by-step plan.