The operating system, known as CVOS (Cisco Voice Operation System), is a locked down version of either RHEL or CentOS. This get updated by upgrading to a new version by a non-bootable ISO file or if there are defects that can be corrected by a COP file. Checking for security defects is best done by subscribing to notifications from Cisco, but you could also check on their security advisories page(s).
On the backup part, you can not use snapshots, so Veem is out of the question because of this, as Cisco do not support using snapshots as that puts a heavy tole on the performance of the file system. There is a a backup option built into the system called DRS, it backups the database and some file system level files that is needed for the restore.
Like other voice applications which run on Linux you don't need patch updates on the Linux levels. Upgrading the CUC versions will do that job.
I have voice applications running on linux which we installed and we do upgrade the underlying linux od apply patch when ever the scanner report any vulnerability.
But I never received vulnerability mentioned by the scanner regarding underlying Linux of CUCM and CUC.But i used to get mails regarding the Application vulnarability.
