An organization's production server recently crashed right after they completed installing a security patch. To minimize the probability of this happening again, what should the organization do$?$

The organization should approve the patch only after doing a proper risk assessment

The organization should apply the patch according to the vendor's patch release notes

The organization should ensure that there is a good change management process in place

The organization should thoroughly test the patch before sending it into the production environment