Wouldn't it be great if there was an easy way to specify that devices should be on the last X cumulative updates in a compliance policy? Here is the solution for this!