Hi,
The best way depends on how you have configured the devices.
If all devices are set to authenticate to primary first and then the secondaries then upgrade the secondary ACS servers first and at last the primary.
If the primary on the devices differ then it really does not make a difference which one you upgrade first.
The main consideration is that replication does not work with ACS servers on different platform. So any changes will not be replicate properly until all 3 are on the same platform.
