If it cannot be confirmed that the upgrade was applied in time, any provider credentials held by the gateway should be rotated, gateway logs should be brought under monitoring, and version checks should be added to monthly asset inventory reports.