Patch management
Patch management is the routine an organisation follows to find, install and check software updates on every device and service it uses. Cyber Essentials calls this control security update management. It requires automatic updates where possible and critical or high-risk fixes within 14 days, asked at A6.4 to A6.5.2, with A6.4 and A6.5 automatic fails on a No.
- Term
- Patch management
- Also known as
- Patching, Update management, Security update management
- Category
- Devices and software
- Requirement area
- 3. Security Update Management
- Reviewed against
- Requirements v3.3
What does the term patch management mean in Cyber Essentials?
Patch management is the routine an organisation follows to find, install and check software updates on every device and service it uses.
You must make sure that all software in scope is kept up to date.
How does patch management apply to Cyber Essentials?
In plain terms
Think of the servicing schedule for a fleet of vans. Someone knows what is due, books it in and checks it was done. Without that routine, the one van that missed its service is the one that breaks down. Patch management is the same routine for laptops, phones, servers, firewalls and the software on them.
What Cyber Essentials asks
The requirement is quoted above. Automatic updates must be enabled where possible (A6.4.1 for operating systems, A6.5.1 for applications). Where they are not, A6.4.2 and A6.5.2 ask you to describe how critical and high-risk updates still go on within 14 days. The IASME guidance accepts that "It is not always possible to apply auto updates, this is often the case when you have critical systems or servers and you need to be in control of the updating process."
The A6.4 guidance is strict: "If you cannot achieve this requirement at all times, you will not achieve compliance to this question." A6.4 and A6.5 are automatic fails if answered No.
Common mistakes
- Patching Windows and nothing else. Browsers, PDF readers, Java, firewall firmware and browser extensions are all in scope.
- Assuming updates installed because they were approved. Check a report that shows they landed on every device. Cyber Essentials Plus test case 2 scans sampled devices to confirm it.
- Leaving servers that need manual updates without a written routine for A6.4.2.
See the security update management requirements, the 14-day rule in practice and the Microsoft Intune setup guide. Related: security update, remote monitoring and management, CVSS.
Related terms
- Security update (security patch)A security update is a fix released by a software maker to close a known weakness that attackers could use to break in.
- Remote monitoring and management (RMM)Remote monitoring and management is software that lets an IT team or provider check, update and fix an organisation's computers from a distance.
- CVSS (Common Vulnerability Scoring System)CVSS, the Common Vulnerability Scoring System, is the 0 to 10 scale Cyber Essentials uses to define critical and high-risk vulnerabilities.
- Secure configurationSecure configuration means changing the factory settings on computers, phones, servers and cloud services so they only do what the business needs and have no easy ways in.
- ServersServers, in Cyber Essentials, are devices that provide organisational data or services to other devices as part of your organisation's business.
- SoftwareIn Cyber Essentials, software is any operating system, off-the-shelf application, extension, interpreter, script, library, network software or firewall and router firmware.
Frequently asked questions
Patch management is the routine an organisation follows to find, install and check software updates on every device and service it uses. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, patch management comes up at A6.4, A6.4.1, A6.4.2, A6.5, A6.5.1, A6.5.2. Read those questions against the definition above so your answers use the term the way the assessor will.
Patch management relates to 3. Security Update Management in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.