Although we will look at patching and maintenance in much greater detail later in this book, it deserves a mention here as it dovetails nicely into the discussion on commonality and deviations.
If nothing else, you are going to have to patch your Linux environment. For security reasons alone, this is a given and good practice, even in an air-gapped environment. Let's say that your environment is made up entirely of virtual machines and that you decided to standardize on CentOS 7.2 some time ago. You built a virtual machine, performed all of the required configuration steps to turn it into your SOE image, and then converted it into a template for your virtualization environment. This becomes your gold build. So far, so good.
However, CentOS 7.2 was released in December 2015, nearly 4 years ago at the time of writing, and if you were to deploy such...