As Check Point can be in some way not really friendly in regards of upgrade, here are steps we are doing while upgrading jumbo or major upgrade:
1. Schedule maintanance window with potentional service outage in case of disaster
2. snapshot of both nodes, backup of both nodes. In case of VSX also management backup, snapshot, export.
3. transfer all backups outside of the box
Steps on current standby member:
4. upgrade CPUSE deployment agent to newest version
5. import + verify + install (if verify passed) hotfix
6. Let the standby member reboot automatically
7. Once standby member is up and running as standby, do all needed healthchecks
8. if all HCs are fine, policy install on both members. Check warnings after policy installation for any suspisous messages
9. HC again
10. Wait 10 minutes and perform failover
11. Ask everyone to do all needed tests if all is running fine (latency, speed, ...)
12. Grace period of 1 week in case some issue will pop-up after XY minutes/hours/days
13. After all is fine with upgraded member, repeat steps 4 - 11 on second member
You have to be paranoid in these times and do as much as possible to avoid service disruptions. If there is some, you can easily failover back while still have possibility to investigate issue with TAC.
Installing the policy should be mentioned in every jumbo SK...