Cyber Essentials requires every critical or high-risk security update, meaning a CVSS v3 base score of 7 or above or any update with no severity given, to be installed within 14 days of release. That covers operating systems, applications, browser extensions and firewall or router firmware. Auto-update satisfies the rule if you can show it is on.
Key takeaways
- NCSC Requirements v3.3 requires critical and high-risk security updates, meaning a CVSS v3 base score of 7 or above or no severity given, to be installed within 14 days of release.
- The 14 days run from the vendor's release date, not from when you noticed, and cover firewall and router firmware as well as operating systems and applications.
- Under the Danzell guidance, a no to A6.4 (operating systems and firmware) or A6.5 (applications) is an automatic fail.
- Feature updates and optional updates are not required within 14 days; the A6.4 and A6.5 guidance says so explicitly.
- Rule
- Critical and high-risk security updates installed within 14 days of release
- Critical or high risk means
- Vendor rates it critical or high, a CVSS v3 base score of 7 or above, or the vendor gives no severity
- Covers
- Operating systems, applications and extensions, router and firewall firmware
- Questions
- A6.4 and A6.5 (automatic fail on a No), A6.4.1, A6.4.2, A6.5.1, A6.5.2
- Not required in 14 days
- Feature updates and optional updates
- CE Plus check
- Test case 2, authenticated patch scan of sampled devices
The rule itself is one sentence in the security update management section of Requirements v3.3. Software must "be updated, including vulnerability fixes, within 14 days of release" where the vendor calls the fix critical or high risk, where it carries a CVSS v3 base score of 7 or above, or where the vendor gives no severity at all. The requirements note that 14 days is "a reasonable period" and that anything longer "would constitute a serious security risk".
The sentence is short. Applying it across six vendor cycles is where organisations lose the plot.
How does the window map to each vendor?
| Vendor | Release pattern | What passes A6.4 or A6.5 |
|---|---|---|
| Microsoft Windows | Cumulative update on the second Tuesday of the month, plus out-of-band fixes | Windows Update or Intune ring with deferral of 7 days or less, no pausing beyond the window |
| Apple macOS and iOS | Point releases and security responses at irregular intervals | Automatic updates on, including "Install Security Responses and system files" on the Mac, with MDM enforcement where used |
| Google Chrome, Microsoft Edge | Frequent security releases, sometimes more than once a month | Browser auto-update on and the browser restarted; a relaunch pending for three weeks is an installed-but-not-applied update |
| Microsoft 365 Apps (Office) | Security updates on the second Tuesday of the month in every update channel | Updates enabled and the installed build current for its channel; a build that has stopped updating, or a channel version past its support date, gets no new fixes |
| Firewall and router firmware | Vendor advisories, no fixed cadence | Someone subscribed to the advisory, a change window inside 14 days, the version recorded |
| Everything else in A6.2.x | Varies | Auto-update where offered; otherwise a monthly check with a written owner |
Two rows commonly cause fails: the browser relaunch and the firewall.
Why does the firewall catch people out?
A6.4AUTO-FAIL names "router and firewall firmware" in the question itself, and A6.1 treats firmware as an operating system for support purposes. Firewalls do not auto-update by default, and the advisory for a critical CVE is emailed to whichever address registered the device years ago.
The firewall is often the device that sits outside the window. The fix is administrative, not technical: register for the vendor's security advisories on a monitored mailbox, record the running firmware version in your evidence, and book a monthly change slot even when there is nothing to install.
At Cyber Essentials Plus, test case 2 scans sampled devices with an authenticated vulnerability scanner and fails any device with a qualifying fix available for more than 14 days. The specification says virtual patching is not an acceptable long-term mitigation for legacy unsupported operating systems; see authenticated scan for how the test reads each device. The pass condition is the fix itself: a firewall with a critical fix released six weeks ago and not installed is a fail, whatever IPS signature sits in front of it.
Does auto-update satisfy the requirement on its own?
Yes, with a condition. A6.4.1 and A6.5.1 ask whether updates are applied by enabling auto-update. Answering yes closes the question. The condition is that you can show it is on and working: a device that has auto-update enabled but has not rebooted since March is not patched.
Where auto-update is off, A6.4.2 and A6.5.2 ask how you ensure the 14 days. That answer needs a tool that reports missing updates, a person who reads the report, and a cadence shorter than the window. "We check monthly" can leave a fix at 30 days; "we review the compliance report weekly and remediate within the same week" cannot.
What does a 14-day process look like on a calendar?
Take a Windows fix released on Patch Tuesday, the 8th of the month. The window closes on the 22nd. An Intune ring with a 7-day deferral installs on the 15th, with a further deadline and grace period that still land inside the 22nd. A ring with a 14-day deferral installs on the 22nd and any device that is switched off that day is out of the window.
Apple releases do not follow a calendar. The same arithmetic applies from whatever day the point release lands, which is why MDM-enforced automatic updates, rather than a monthly reminder email, is the setting we recommend.
Chrome shows "Update" in the toolbar for three weeks because nobody closes the browser. The update was downloaded within days; it was not installed. The requirement is about the installed version, and the Plus authenticated scan reads the version that is actually running. Set a relaunch deadline in browser policy so the window is enforced without relying on users.
What evidence shows you meet the 14 days?
You do not upload evidence for the self-assessment, but your notes answers should describe something you could show. For a Plus audit, the authenticated scan is the evidence. Four records cover most organisations:
| Record | What it proves | Which question it supports |
|---|---|---|
| The update policy or ring settings in your MDM, with the deferral and deadline | Auto-update is on and enforced | A6.4.1, A6.5.1 |
| A patch compliance report filtered to updates older than 14 days, reviewed on a fixed day | Someone checks the window and acts on it | A6.4.2, A6.5.2 |
| Each firewall and router's running firmware version and the date you last checked the vendor's advisories | Firmware is inside A6.4 | A6.4AUTO-FAIL |
| The software list from A6.2.x checked against vendor support dates | Everything still receives fixes | A6.1, A6.3 |
The is it supported tool checks support dates, and the security update management questions show what each notes answer needs to contain.
Where do you set each of these?
The platform setup guides walk through the update settings for Windows 11, macOS, iOS and iPadOS, Microsoft Intune and the common firewall vendors, including FortiGate, Sophos and WatchGuard. The security update management hub covers A6.1 to A6.7 in full, including what to do with software that cannot be updated. If you are not sure whether your current reporting can prove the 14 days, the readiness checker asks the question directly, and a gap analysis will pull the reports with you before an assessor asks for them.
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026 (v16.3)Read on iasme.co.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials Plus Test Specification v3.2Read on ncsc.gov.uk (opens in a new tab)
- learn.microsoft.comMicrosoft Learn, Overview of update channels for Microsoft 365 AppsRead on learn.microsoft.com (opens in a new tab)
- support.apple.comApple Support, Keep your Mac up to dateRead on support.apple.com (opens in a new tab)
Frequently asked questions
From release. The requirement text is 'within 14 days of release'. The Cyber Essentials Plus authenticated scan applies the same test: a qualifying fix that has been available for more than 14 days is a fail for that device, whether or not anyone had seen it.
No. The A6.4 and A6.5 guidance says you are not required to install feature updates or optional updates. The rule covers security updates and vulnerability fixes that are critical or high risk, or have no severity given. Installing everything within 14 days is recommended but not mandatory.
The requirements are explicit: if a single update covers any critical or high-risk issue, the whole update must be installed within 14 days. You cannot defer the bundle because most of its contents are minor.
Home routers are out of scope and are not listed in A2.5, so no. It applies to any firewall or router you have placed in scope, and to a router your organisation issues to a home worker, which is in scope under the home and remote working section.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh