A6.4.1: Are operating system updates applied automatically?
Are all updates applied for operating systems by enabling auto updates?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
Answer Yes to A6.4.1 if automatic updates are enabled for operating systems on every device where it is possible. The requirement is that all software has automatic updates enabled where possible. Where it is not, for example on servers you patch under change control, describe that process in A6.4.2. Either way, critical fixes must land within 14 days.
Is A6.4.1 an automatic fail?
No. A6.4.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- Most devices have the option to enable auto updates. This must be enabled on any device where possible.
- Requirement enforced
All software on in-scope devices must have automatic updates enabled where possible.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A6.4AUTO-FAILA6.4.2Back to the security update management control
What does A6.4.1 ask?
A6.4.1 asks: “Are all updates applied for operating systems by enabling auto updates?”
A6.4.1 asks whether all updates are applied for operating systems by enabling auto updates. The guidance says most devices can enable auto updates and that this must be enabled on any device where possible.
The requirement behind it: all software on in-scope devices must have automatic updates enabled where possible. 'Where possible' leaves room for systems you need to control, such as servers, which A6.4.2 covers. The 14-day rule in A6.4 applies either way. See the Intune and Windows 11 setup guides.
What must be true to answer Yes to A6.4.1?
You can answer Yes to A6.4.1 only when all of the following are true today, across every device, user and cloud service in scope.
- Windows Update, macOS software update, iOS, iPadOS and Android automatic updates are on, ideally enforced by MDM.
- Deferral periods for quality and security updates are short enough that critical updates install within 14 days.
- Devices restart to apply updates within a set deadline.
- If any device type is patched manually, answer accordingly and describe it in A6.4.2.
Why do applicants fail A6.4.1?
A common reason applicants fail A6.4.1: auto-update on but quality update deferrals of 30 days.
- Updates download but users postpone restarts indefinitely.
- BYOD devices with automatic updates turned off.
- Answering Yes when servers and firewalls are patched manually.
How do you fix a failing A6.4.1 answer?
If your answer to A6.4.1 would not pass today, fix the control first and then write the answer. In order:
- Turn on automatic updates for Windows, macOS, iOS, iPadOS and Android through your MDM.
- Shorten any deferrals and set restart deadlines.
- Answer No and describe the manual process in A6.4.2 if servers or firewalls are patched by hand.
How do assessors check A6.4.1?
What evidence should you keep for A6.4.1?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A6.4.1:
- The automatic update policies in your MDM for each operating system.
Where to go next
- Microsoft Intune setupSetup guide
- Windows 11 setupSetup guide
- macOS setupSetup guide
- Patch managementGlossary
- Is it supported?Check a product's support status
- Security Update Management requirementsThe control this question tests
- All A6 questionsSecurity update management
- Cyber Essentials checklistThe evidence to gather for every question
Other A6 questions
- A6.3.1A6.3.1NotesIf yes to A6.3, please list the unsupported or unlicensed software or cloud services.Notes
- A6.4A6.4Auto-failAre all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?Auto-fail
- A6.4.2A6.4.2NotesWhere auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all operating systems and firmware on firewalls and routers are applied…Notes
- A6.5A6.5Auto-failAre all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release?Auto-fail
Frequently asked questions
A6.4.1 in the 2026 Danzell Cyber Essentials question set asks: "Are all updates applied for operating systems by enabling auto updates?" It is a Yes/No question.
Answer Yes to A6.4.1 if automatic updates are enabled for operating systems on every device where it is possible. The requirement is that all software has automatic updates enabled where possible. Where it is not, for example on servers you patch under change control, describe that process in A6.4.2. Either way, critical fixes must land within 14 days.
No. A6.4.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Where possible, yes. The requirement is that all software has automatic updates enabled where possible. Where you must control updates, describe the process in A6.4.2 and still meet 14 days for critical and high-risk fixes.
Yes, as long as critical and high-risk security updates are still installed within 14 days of release. A quality update deferral of more than 14 days breaks the rule.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh