Steve Pruitt has created a great blog post this topic. Check it out: http://myitforum.com/cs2/blogs/spruitt/archive/2007/07/19/patching-standards-or-objectives.aspx