2 days? Tell them they're dreaming.
"mandate application and operating system patching
within two days of an update release"
How are you expected to do the following in 2 days:
1) Download patch(es);
2) Deploy the patches to an RnD environment to see how the patch process runs, whether it can be automated or requires a GUI and clicking on 'next' buttons;
3) Package/otherwise automate the patch for easy deployment to 100's of servers;
4) arrange downtime for the dev environment to deploy the patch and any restarts that are required;
5) install patch, perform any necessary restarts;
6) Get signoff that the patch hasn't broken anything in dev and can proceed to the next environment;
7) arrange downtime for the integration environment to apply the patch;
8) install patch, perform any necessary restarts;
9) get integration testing team signoff that the patch hasn't broken anything;
10) arrange downtime in the system/performace testing environment to apply patches;
11) apply patches in the system/performance testing environment and perform any necessary restarts;
12) get signoff from testing team that patch doesn't break anything/cause performance issues;
13) arrange downtime for production, including notifying external agencies that depend on your systems, informing other national governments that you have MOUs with stating 10-day notification of any outages to critical systems that they interface with;
14) apply patch and perform any restarts that are necessary;
15) cross fingers and hope no backout is required of the patch thats just been rushed through with limited verification testing.
16) retrofit patch to other non-critical path environemnts - training, other dev/integration environments that are being used for future releases (can have up to 3 streams running simultaneously, current prod, next release, release after next release...)
Multiply this by 100's of servers that an O/S patch may have to be applied to, and fight for outage windows and testing resources in environments that are fully booked for testing of the next LEGISLATIVE release that has to BY LAW go in in anywhere from 24 hours to 3 months away who (as usual) is running behind schedule..
Sounds like they need to be hit with the reality stick.