Security update (security patch)
A security update is a fix released by a software maker to close a known weakness that attackers could use to break in. Cyber Essentials requires updates rated critical or high risk, scored CVSS 7 or above, or released without a severity rating to be installed within 14 days. A6.4 and A6.5 are automatic fails if answered No.
- Term
- Security update
- Also known as
- Security patch, Patch, Hotfix
- Category
- Devices and software
- Requirement area
- 3. Security Update Management
- Reviewed against
- Requirements v3.3
What does the term security update mean in Cyber Essentials?
A security update is a fix released by a software maker to close a known weakness that attackers could use to break in.
Product vendors provide fixes for vulnerabilities identified in products that they still support, in the form of patches, security updates, registry fixes, scripts, configuration changes or any other mechanism prescribed by the vendor to fix a known vulnerability.
How does security update apply to Cyber Essentials?
In plain terms
A security update is like a manufacturer's recall for a faulty lock. The maker finds the fault and sends out a fix, but your door is only safe once the fix is fitted. The "Update and restart" prompt on a laptop and the update badge on a phone are the everyday versions.
What Cyber Essentials asks
All software in scope must be updated within 14 days of release where the update fixes vulnerabilities the vendor calls critical or high risk, where it addresses vulnerabilities with a CVSS v3 base score of 7 or above, or where the vendor gives no details of the level of vulnerabilities fixed. If one update fixes several issues and any of them is critical or high risk, the whole update is due within 14 days.
A6.4 covers operating systems and router and firewall firmware, and A6.5 covers other software. Both are automatic fails on a No. A6.4.1 and A6.5.1 ask whether automatic updates are turned on, which the requirement expects "where possible". The A6.4 guidance adds: "You are not required to install feature updates or optional updates in order to meet this requirement." The NCSC still recommends applying all updates within 14 days.
What an assessor looks for
For Cyber Essentials Plus, test case 2 runs an authenticated vulnerability scan on sampled devices. The assessor records a fail if a qualifying fix has been available for more than 14 days and is not installed.
See the security update management requirements, the 14-day rule in practice and Cyber Essentials Plus test 2. Related: vulnerability fixes, CVSS, patch management.
Related terms
- Vulnerability fixesVulnerability fixes are patches, updates, registry fixes, configuration changes, scripts or any other mechanism approved by the vendor to fix a known vulnerability.
- CVSS (Common Vulnerability Scoring System)CVSS, the Common Vulnerability Scoring System, is the 0 to 10 scale Cyber Essentials uses to define critical and high-risk vulnerabilities.
- Patch managementPatch management is the routine an organisation follows to find, install and check software updates on every device and service it uses.
- ServersServers, in Cyber Essentials, are devices that provide organisational data or services to other devices as part of your organisation's business.
- SoftwareIn Cyber Essentials, software is any operating system, off-the-shelf application, extension, interpreter, script, library, network software or firewall and router firmware.
- Thin clientA thin client is a simple, low-powered computer that mainly acts as a screen and keyboard for a virtual desktop running somewhere else.
Frequently asked questions
A security update is a fix released by a software maker to close a known weakness that attackers could use to break in. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, security update comes up at A6.4, A6.4.1, A6.5, A6.5.1. Read those questions against the definition above so your answers use the term the way the assessor will.
Security update relates to 3. Security Update Management in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.