A6.4: Are critical and high-risk operating system and firmware updates installed within 14 days?
Are all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
To answer Yes to A6.4 every high-risk or critical security update and vulnerability fix for operating systems and for router and firewall firmware must be installed within 14 days of release, in all circumstances, on every device in scope. Under the Danzell question set a No is an automatic fail. Feature updates and optional updates are not required.
Is A6.4 an automatic fail?
Yes. A6.4 is one of the four questions in the 2026 Danzell question set that fail automatically on a No answer (A6.4, A6.5, A7.16 and A7.17): answering No fails the whole Cyber Essentials assessment, whatever the other answers say.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- You must install all high and critical security updates and vulnerability fixes within 14 days in all circumstances. If you cannot achieve this requirement at all times, you will not achieve compliance to this question.
- Requirement enforced
All software on in-scope devices must be updated, including vulnerability fixes, within 14 days of release, where:
- The update fixes vulnerabilities described by the vendor as ‘critical’ or ‘high-risk’
- The update addresses vulnerabilities with a CVSSv3 base score of 7 or above
- There are no details of the level of vulnerabilities the update fixes provided by the vendor
Please note: For optimum security we strongly recommend (but it’s not mandatory) that all released updates are applied within 14 days of release.
It's important that updates are applied as soon as possible. 14 days is considered a reasonable period to be able to implement this requirement. Any longer would constitute a serious security risk while a shorter period may not be practical.
- Outcome if non-compliant
- Automatic fail on a No answer under the Danzell question set
- Related questions
- A6.3.1A6.4.1Back to the security update management control
What does A6.4 ask?
A6.4 asks: “Are all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?”
A6.4 asks whether all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware are installed within 14 days of release. The guidance says you must achieve this in all circumstances, that if you cannot achieve it at all times you will not achieve compliance, and that the answer No is an automatic fail.
The requirement behind it: all software on in-scope devices must be updated, including vulnerability fixes, within 14 days of release where the update fixes vulnerabilities described by the vendor as critical or high risk, where it addresses vulnerabilities with a CVSS v3 base score of 7 or above, or where the vendor provides no details of the level of vulnerabilities the update fixes.
Vulnerability fixes include patches, updates, registry fixes, configuration changes, scripts or any other mechanism approved by the vendor to fix a known vulnerability. Applying all released updates within 14 days is strongly recommended but not mandatory. If a vendor bundles fixes of differing severity into one update and any of them is critical or high risk, the whole update must go in within 14 days. See the 14-day rule in practice and CE Plus test case 2.
What must be true to answer Yes to A6.4?
You can answer Yes to A6.4 only when all of the following are true today, across every device, user and cloud service in scope.
- Operating system updates are applied automatically (A6.4.1) or through a managed process that guarantees a 14-day maximum from release, including out-of-band releases (A6.4.2).
- Firewall and router firmware has an owner and a process, because those devices rarely auto-update.
- Devices that are rarely on, such as spare laptops and conference room PCs, are either kept updated or removed from scope.
- You can show the state today, for example an Intune or RMM compliance report with no device more than 14 days behind on a critical update.
Why do applicants fail A6.4?
A common reason applicants fail A6.4: a monthly patch cycle with no mechanism for critical releases that land mid-cycle.
- Firewall firmware treated as 'set and forget' for years.
- Devices that miss the deployment window because they are off, remote or not enrolled in management.
- Deferral policies in Intune or WSUS set longer than 14 days, or update rings that hold a cohort for a month.
How do you fix a failing A6.4 answer?
If your answer to A6.4 would not pass today, fix the control first and then write the answer. In order:
- Turn on automatic operating system updates on every device where possible, enforced by MDM.
- Set update deferrals for security updates to well under 14 days and set restart deadlines.
- Give firewall and router firmware a named owner who checks vendor advisories and applies critical fixes within 14 days.
- Run a compliance report and fix or remove any device more than 14 days behind on a critical or high-risk update.
How do assessors check A6.4?
What evidence should you keep for A6.4?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A6.4:
- An Intune, RMM or WSUS compliance report showing no device more than 14 days behind on critical or high-risk updates.
- The update ring or deferral settings.
Where to go next
- The 14-day rule in practicePatching that meets the deadline
- CE Plus test 2: patch scanCyber Essentials Plus
- Microsoft Intune setupSetup guide
- CVSSGlossary
- Is it supported?Check a product's support status
- Security Update Management requirementsThe control this question tests
- All A6 questionsSecurity update management
- Cyber Essentials checklistThe evidence to gather for every question
Other A6 questions
- A6.3A6.3Yes/NoAre any of the in-scope software or cloud services unlicensed or unsupported?Yes/No
- A6.3.1A6.3.1NotesIf yes to A6.3, please list the unsupported or unlicensed software or cloud services.Notes
- A6.4.1A6.4.1Yes/NoAre all updates applied for operating systems by enabling auto updates?Yes/No
- A6.4.2A6.4.2NotesWhere auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all operating systems and firmware on firewalls and routers are applied…Notes
Frequently asked questions
A6.4 in the 2026 Danzell Cyber Essentials question set asks: "Are all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?" It is a Yes/No question.
To answer Yes to A6.4 every high-risk or critical security update and vulnerability fix for operating systems and for router and firewall firmware must be installed within 14 days of release, in all circumstances, on every device in scope. Under the Danzell question set a No is an automatic fail. Feature updates and optional updates are not required.
Yes. The guidance states that this will be an automatic fail if the answer is no. Fix the control before you submit rather than rely on the notes field to explain a gap.
Yes. A6.4 says the requirement includes the firmware on your firewalls and routers. Because network devices rarely update themselves, you need a named owner and a check on vendor security bulletins.
No. The guidance says you are not required to install feature updates or optional updates in order to meet this requirement. Only high-risk or critical security updates and vulnerability fixes are in scope of the 14 days.
Then the update must still be installed within 14 days. The requirement covers updates where there are no details of the level of vulnerabilities provided by the vendor, so unrated updates are treated as if they were critical.
Test case 2 scans a sample of end user devices, servers and IaaS instances with credentials. Any vulnerability rated critical or high, scoring CVSS v3 7 or above, or unrated, whose fix has been available for more than 14 days, fails the sub-test. Virtual patching is not accepted for unsupported operating systems.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh