Vulnerability fixes
Vulnerability fixes are patches, updates, registry fixes, configuration changes, scripts or any other mechanism approved by the vendor to fix a known vulnerability. Under Cyber Essentials v3.3, fixes for critical or high-risk vulnerabilities must be installed within 14 days of release. A6.4 and A6.5 are automatic fails if answered No.
- Term
- Vulnerability fixes
- Also known as
- Patches
- Category
- Devices and software
- Requirement area
- B. Definitions; 3. Security Update Management
- Questions
- A6.1A6.4AUTO-FAILA6.5AUTO-FAIL
- Reviewed against
- Requirements v3.3
What does the term vulnerability fixes mean in Cyber Essentials?
Vulnerability fixes are patches, updates, registry fixes, configuration changes, scripts or any other mechanism approved by the vendor to fix a known vulnerability.
Vulnerability fixes include patches, updates, registry fixes, configuration changes, scripts or any other mechanism approved by the vendor to fix a known vulnerability.
How does vulnerability fixes apply to Cyber Essentials?
In plain terms
A vulnerability fix is whatever the vendor tells you to do to close a known security hole. Usually that is installing an update. Sometimes it is a registry change, a configuration setting or a script, published as a workaround while a full patch is prepared. Under Cyber Essentials, all of these count as fixes and all of them carry the same deadline.
What does Cyber Essentials require?
Section B defines the term as quoted above. The security update management requirement says software must be "updated, including vulnerability fixes, within 14 days of release" where the fix addresses a vulnerability that is any of:
| Trigger | Example |
|---|---|
| Described by the vendor as critical or high risk | A Microsoft Patch Tuesday update rated Critical |
| Rated CVSS v3 base score 7 or above | A browser flaw published with a base score of 8.8 |
| Released with no details of the level of vulnerability | A firmware update whose notes say only "security fixes" |
Which questions apply?
A6.4 asks about fixes for operating systems and router and firewall firmware, and A6.5 for other software; under the Danzell question set both are automatic fails if answered No. A6.1 and A6.3 depend on the vendor still producing fixes at all: software that no longer gets them is unsupported. CE Plus test case 2 identifies missing fixes through an authenticated scan and fails any device where "the vendor has provided a vulnerability fix which has been available for more than 14 days".
What an assessor looks for
- Fixes applied, not only approved. A patch report showing installation across every device type is stronger evidence than a policy.
- Vendor workarounds applied where a vendor has published one as the fix.
- No reliance on virtual patching for unsupported systems. The test specification says it "will not be recognised as a mechanism for compliance".
See the security update management requirements, the 14-day rule in practice and CVSS. Related: security update, zero-day, patch management.
Related terms
- CVSS (Common Vulnerability Scoring System)CVSS, the Common Vulnerability Scoring System, is the 0 to 10 scale Cyber Essentials uses to define critical and high-risk vulnerabilities.
- Security update (security patch)A security update is a fix released by a software maker to close a known weakness that attackers could use to break in.
- Zero-day vulnerabilityA zero-day is a security flaw that attackers know about and can use before the software maker has released a fix, so defenders have had zero days to patch it.
- Patch managementPatch management is the routine an organisation follows to find, install and check software updates on every device and service it uses.
- Auto-run (AutoRun and AutoPlay)Auto-run is a feature that opens or runs a file automatically, without asking, for example when a USB stick is plugged in or a download finishes.
- Browser extensionA browser extension is a small add-on program that adds a feature to a web browser, such as a password manager, ad blocker or PDF tool.
Frequently asked questions
Vulnerability fixes are patches, updates, registry fixes, configuration changes, scripts or any other mechanism approved by the vendor to fix a known vulnerability. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, vulnerability fixes comes up at A6.1, A6.4, A6.5. Read those questions against the definition above so your answers use the term the way the assessor will.
Vulnerability fixes relates to B. Definitions; 3. Security Update Management in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.