Cyber Essentials A6 questions: security update management
The A6 questions test control 3: supported operating systems and software, software version lists, removal of unsupported software and the 14-day rule. Two, A6.4 and A6.5, are automatic fails.
Section A6 tests security update management and contains two automatic fails, A6.4 and A6.5, both on the 14-day rule. It asks whether operating systems, firmware and applications are supported, lists key software versions, asks whether unsupported software has been removed or segregated, and whether critical or high-risk fixes are installed within 14 days.
- Questions
- 16 (A6.1 to A6.7)
- Auto-fails
- A6.4, A6.5
- CE Plus test
- Test 2: authenticated patch scan
What questions are in section A6?
Section A6 has 16 questions, A6.1 to A6.7, of which A6.4, A6.5 are automatic fails. Each page gives the exact wording, what a compliant answer looks like and a model answer.
- A6.1A6.1Yes/NoAre all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes?Yes/No
- A6.2A6.2Yes/NoIs all the software on your devices supported by a supplier that produces regular vulnerability fixes for any security problems?Yes/No
- A6.2.1A6.2.1NotesPlease list your internet browser(s).Notes
- A6.2.2A6.2.2NotesPlease list your malware protection softwareNotes
- A6.2.3A6.2.3NotesPlease list your email applications installed on end user devices and servers.Notes
- A6.2.4A6.2.4NotesPlease list all office applications that are used to create organisational data.Notes
- A6.3A6.3Yes/NoAre any of the in-scope software or cloud services unlicensed or unsupported?Yes/No
- A6.3.1A6.3.1NotesIf yes to A6.3, please list the unsupported or unlicensed software or cloud services.Conditional: if yes to A6.3Notes
- A6.4A6.4Auto-failAre all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?Auto-fail
- A6.4.1A6.4.1Yes/NoAre all updates applied for operating systems by enabling auto updates?Yes/No
- A6.4.2A6.4.2NotesWhere auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all operating systems and firmware on firewalls and routers are applied…Notes
- A6.5A6.5Auto-failAre all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release?Auto-fail
- A6.5.1A6.5.1Yes/NoAre all updates applied on your applications by enabling auto updates?Yes/No
- A6.5.2A6.5.2NotesWhere auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all software are applied within 14 days of release?Notes
- A6.6A6.6Yes/NoHave you removed any software installed on your devices that is no longer supported and no longer receives regular updates or vulnerability fixes for security problems?Yes/No
- A6.7A6.7NotesWhere you have a business need to use unsupported software, have you moved the devices and software out of scope of this assessment? Please explain how you achieve this.Notes
How do assessors mark section A6?
Assessors read section A6 as a whole and against the scope inventory in A2: every answer must be true across the whole scope and consistent with the rest of the submission.
Related requirements
- Security Update Management requirementsThe control hub with every requirement bullet
- All questionsThe eight sections
- Requirements overviewThe five controls
- What changed in 2026Danzell and v3.3
- Cyber Essentials checklistThe evidence to gather for each question
- Check your readinessScore your answers against the auto-fails first
Frequently asked questions
16, from A6.1 to A6.7. 1 of them are conditional and only appear depending on an earlier answer.
Yes: A6.4, A6.5. Under the 2026 Danzell question set, a No to A6.4 or A6.5 fails the assessment outright.
8 Yes/No, 8 notes and 0 multiple choice questions.
Yes. The control applies to firewalls and routers, and A6.4 states that firmware on firewalls and routers is considered an operating system. Critical or high-risk firmware fixes must be installed within 14 days of release, which usually means an explicit process because network devices rarely auto-update.
For Cyber Essentials, critical or high-risk vulnerabilities are those with a CVSS v3 base score of 7 or above, or those the vendor identifies as critical or high risk. If the vendor gives no severity at all, the update must also be installed within 14 days.
Only with Extended Security Updates. The A6.1 guidance says that if you are using Windows 10 beyond 14 October 2025 you must be signed up to the Microsoft Extended Security Update programme to remain compliant, and that you must maintain the required subscription. Without a current subscription, Windows 10 is unsupported software in scope, so the licensed-and-supported requirement is not met and the application will not pass.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh