Apply security updates immediately when they are released. Delaying security updates is the most common cause of Drupal site compromises.
For bug fix releases within the same minor version, a monthly schedule is reasonable. These are usually safe drop in updates that improve stability without adding risk. Schedule them during low traffic windows and test briefly on staging first.
Minor version updates, like going from 11.3 to 11.4, happen every six months. These usually introduce new features and deprecations but maintain backwards compatibility within the major version. Plan a testing window of a few hours to check critical functionality.
Major version upgrades like 10 to 11 happen every two years and require more planning. Check module compatibility, update deprecated code, and test thoroughly. Maintaining a regular update cadence keeps your site secure and reduces the pain of falling behind.