How much time should you allow for regression testing ERP security patches? Any rules of thumb?