# Trusted Operating System Maintenance Tasks
![`smart`](TiDBCloudMaintenanceWindow_aa_001_20231023.png)
+ Patching the guest OS during the maintenance window
+ AWS Security Groups and GCP Firewalls
+ Controlled access with logs
+ Penetration testing
------------------------------------------------------------------------------
TiDB Cloud can perform a rolling upgrade of the underlying operating system, allowing you to patch it without the need to log into the operating system. If the patching process involves upgrading the TiDB cluster version, PingCAP will notify you of the specific time window for the upgrade. This ensures uninterrupted access to your data as it patches the operating system and upgrades the TiDB cluster version online.

The TiDB Cloud operation platform utilizes a predefined allow-list of maintenance commands to filter and execute only trusted commands remotely, while additionally restricting any interactive login to the operating system. All operations are logged and undergo auditing.

TiDB Cloud utilizes the firewalls offered by the Cloud Infrastructure vendors and follows the best practices for safeguarding the guest OS. 

TiDB Cloud conduct commercial penetration testing regularly and the testing meets PCI security compliance requirements. 

A maintenance window (TiDB Dedicated only) is used to schedule the maintenance activities, such as operating system updates, security patches, and infrastructure upgrades, are performed automatically to ensure the reliability, security, and performance of the TiDB Cloud service. During a maintenance window, the maintenance is executed on TiDB clusters one by one so the overall performance impact is minimal. Although there might be temporary connection disruptions or QPS fluctuations, the clusters remain available. You can create and edit the maintenance window under `Project Settings`.

For more information about the zero downtime online upgrade ability of TiDB cluster, please visit `https://www.youtube.com/watch?v=HLrIwbMgOhg`.