What is the current state of the art concerning CentOS 7 errata?

This is roughly what we do in our environment.