Bash script to update only security packages on CentOS

I need a script which when placed in crontab has the ability to check the current security related packages installed and ensure they are updated from a repository, when a newer version is available. I don't want OS updates applied or any other packages updated. I don't want auto-reboot. Would like to document updates by having a logfile created / amended each time with old package name/version and new name/version as well as date/time it was updated. I need this for CentOS 6.4 and for CentOS 6.8 right now and so not sure "yum --security list updates" is possible if CentOS aren't using meta data for updates (you tell me?) Optional, but preferred, ability to rollback to previous versions should issues be encountered. Please specify in proposal if this will be included and any additional cost.