As I received this question a couple of times in the past here a short summary of the different update types used with SharePoint:
What is it: A service pack is a combination of previously released fixes, fixes which have only been released in context of the service pack and potentially new functionality added to the product.
What is included: new fixes, new functionality, all previously released fixes (older Service Packs, CUs, PUs)
Multilingual: No. You need separate Service Packs for each installed language
What is the prerequesit: Usually there is no prerequesit to install a service pack.
When to install: it is recommended to evaluate and install Service Packs as soon as possible.
Impact on future fixes: CUs and PUs released more than 12 months after the last service pack can only be installed if the Service Pack has been installed before
Installation Sequence: no specific sequence. You can install a service pack on top of CUs and PUs released later.
Release Cycle: no specific release cycle
Cumulative Update (CU)
What is it: A cumulative update includes fixes for problems with our product that have been reported by customer in context of support cases.
What is included: new and all previously released fixes (CUs and PUs) since the oldest supported service pack (within the first 12 month after a Service Pack has been released the CU includes also fixes released after the previous service pack)
Multilingual: Yes. The CU package includes fixes for all languages.
What is the prerequesit: The oldest supported service pack. Within the first 12 months after releasing a SP you can install on the latest SP and the previous one. CUs released more than 12 months after the newest SP require the newest SP to be installed.
When to install: CUs should only be installed to resolve specific issues fixed with the CUs as mentioned in each CU KB article: "Apply this hotfix only to systems that are experiencing the problems described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.". Or if adviced to install by Microsoft Support.
Impact on future fixes: In general a CU is not a prerequesit of future CUs and PUs. But in some situations a CU can be a prerequesit of a COD (see below).
Installation Sequence: no specific sequence.
Release Cycle: every second month (February, April, June, August, October, December) - since June 2014 CUs are released every month.
Public Update (PU)
What is it: A public update usually includes security fixes for the product or fixes for problems which affect a broad number of customers.
What is included: please review the KB article for each public update in detail to see which fixes are included.
Multilingual: Yes. The PU package includes fixes for all languages.
What is the prerequesit: Usually the oldest supported service pack. Within the first 12 months after releasing a SP you can install on the latest SP and the previous one. PUs released more than 12 months after the newest SP usually require the newest SP to be installed.
When to install: As a PU includes security fixes it is recommended to evaluate and install PUs as soon as possible.
Impact on future fixes: In some situations a PU can be a prerequesit of future CUs and PUs. E.g. the March 2013 PU for SharePoint 2013 will be a prerequesit for all future CUs (and potentially PUs) for SharePoint 2013.
Installation Sequence: A PU can only be installed on a system which does not already have the included fixes applied through another source - e.g. through an earlier released CU. As PUs are advised to be installed by all customers while CUs should only be installed by customers affected by one of the fixes incuded in the CU the test cycle for a PU is much longer than for a CU. That means a PU released in March can be superseeded by a CU released earlier (e.g. February CU or December CU). Also in some situations a CU requires an earlier released PU to be installed first - otherwise the fix will not install.
Release Cycle: once a month (if required)
Critical On Demand Fix (COD)
What is it: A COD is a fix which is provided only to a small number of customers affected by a critical problem directly through Microsoft Support to provide a quick relief. The code change in the COD will be included in one of the next CUs and it is advised to install that CU on top of the COD as soon as it has been released.
What is included: only the specific fix for a specific issue.
Multilingual: Usually not.
What is the prerequesit: Usually the CU that was used as the baseline to develop the COD. Microsoft Support will provide guidance which CU is required to be installed as a prerequesit for the COD.
When to install: Only if advised by Microsoft Support.
Impact on future fixes: A COD will not have an impact on future CUs or PUs. But the next CU can potentially revert the the code change introduced in the COD. See Installation Sequence.
Installation Sequence: As the COD will be released as soon as possible to a small number of affected customers. It might happen, that the next CU released shortly before or after the COD will not include the code change introduced by the COD. Customers which need the fix in the COD have to wait for the CU which will include the fix included in the COD. Microsoft Support will provided guidance on which CU can be installed on top of a COD.
Release Cycle: on demand
Excellent article, Very well writtenb and highly commendable.
it's very helpful! Thank you!
Thanks Stefan! Plan to pass on to User Groups, ISV's and customers.
Hi Stefan - Just to be clear, this applies to SP 2013 and 2010, correct?
Also, are MS monthly security notifications considered a PU, things like the SP 2010 bulletin that just came out (MS13-024)?
That is correct.
Great Stuff! Thanks
Perfect and Nice Explanation !! Thanks a lot !!
Good reference material - thanks Stefan!
Very helpful. thanks.
thanks for sharing.
There is one thing i want to ask...could we apply the service pack or cu on SharePoint 2007 which is already expired?
sorry I don't understand the question.
What do you mean by an expired SharePoint 2007?