A6.4.2: How do you meet 14 days for operating systems without auto-update?
Where auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all operating systems and firmware on firewalls and routers are applied within 14 days of release?
Source: IASME Cyber Essentials Danzell question set v16.3
A compliant A6.4.2 answer explains how critical and high-risk operating system and firewall firmware fixes are installed within 14 days where automatic updates are not used: who monitors releases, how updates are tested and deployed, and how you check nothing was missed. If you use only automatic updates, say so in the notes.
Is A6.4.2 an automatic fail?
No. A6.4.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- It is not always possible to apply auto updates, this is often the case when you have critical systems or servers and you need to be in control of the updating process. Please describe how any updates are applied when auto updates are not configured.
- Requirement enforced
All software on in-scope devices must be updated, including vulnerability fixes, within 14 days of release, where:
- The update fixes vulnerabilities described by the vendor as ‘critical’ or ‘high-risk’
- The update addresses vulnerabilities with a CVSSv3 base score of 7 or above
- There are no details of the level of vulnerabilities the update fixes provided by the vendor
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A6.4.1A6.5AUTO-FAILBack to the security update management control
What does A6.4.2 ask?
A6.4.2 asks: “Where auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all operating systems and firmware on firewalls and routers are applied within 14 days of release?”
A6.4.2 asks how, where auto updates are not used, you ensure all high-risk or critical security updates and vulnerability fixes for operating systems and firewall and router firmware are applied within 14 days of release. The guidance says this is often the case for critical systems or servers where you need control of the process, and that if you only use auto updates you should confirm it here.
The 14-day rule applies where the update fixes vulnerabilities the vendor calls 'critical' or 'high risk', addresses vulnerabilities with a CVSS v3 base score of 7 or above, or comes with no severity details from the vendor. A single update that fixes several issues must go in within 14 days if any of them is critical or high risk. See the 14-day rule in practice and CVSS.
What should you write in the notes field for A6.4.2?
Write two to four specific sentences for A6.4.2: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
Servers: [role / MSP name] reviews Microsoft's monthly release and out-of-band advisories within [2] working days, deploys critical and high-risk updates through [WSUS / Azure Update Manager / RMM] to a pilot server, then to all servers within [7] days of release. Firewalls and routers: [role] subscribes to [vendor] security advisories and applies critical firmware within [7] days. Compliance is checked [weekly] in [tool]; any device more than 14 days behind is escalated to [role]. All other devices use automatic updates (A6.4.1).
Why do applicants fail A6.4.2?
A common reason applicants fail A6.4.2: a monthly patch window with no route for critical out-of-band releases.
- No mention of firewall and router firmware.
- No check that updates actually installed.
- Leaving it blank when everything auto-updates, instead of confirming that.
How do you fix a failing A6.4.2 answer?
If your answer to A6.4.2 would not pass today, fix the control first and then write the answer. In order:
- Name who watches vendor releases, including out-of-band advisories.
- Set a deployment timetable with a maximum under 14 days, including firewall firmware.
- Add a weekly compliance check that escalates anything more than 14 days behind.
- If everything auto-updates, say so in the notes.
How do assessors check A6.4.2?
What evidence should you keep for A6.4.2?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A6.4.2:
- The patching procedure for manually updated systems, and the last month's patch records.
Where to go next
- The 14-day rule in practicePatching that meets the deadline
- CVSSGlossary
- Firewall setup guidesFortiGate, Sophos, DrayTek, Meraki, UniFi, WatchGuard
- Is it supported?Check a product's support status
- CE Plus test 2: authenticated patch scanHow the 14-day rule is tested
- Security Update Management requirementsThe control this question tests
- All A6 questionsSecurity update management
- Cyber Essentials checklistThe evidence to gather for every question
Other A6 questions
- A6.4A6.4Auto-failAre all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?Auto-fail
- A6.4.1A6.4.1Yes/NoAre all updates applied for operating systems by enabling auto updates?Yes/No
- A6.5A6.5Auto-failAre all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release?Auto-fail
- A6.5.1A6.5.1Yes/NoAre all updates applied on your applications by enabling auto updates?Yes/No
Frequently asked questions
A6.4.2 in the 2026 Danzell Cyber Essentials question set asks: "Where auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all operating systems and firmware on firewalls and routers are applied within 14 days of release?" It is a notes question, answered in free text.
A compliant A6.4.2 answer explains how critical and high-risk operating system and firewall firmware fixes are installed within 14 days where automatic updates are not used: who monitors releases, how updates are tested and deployed, and how you check nothing was missed. If you use only automatic updates, say so in the notes.
No. A6.4.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
One the vendor describes as critical or high risk, one that fixes a vulnerability with a CVSS v3 base score of 7 or above, or one where the vendor gives no severity details.
Say so. IASME's A6.4.2 guidance asks you to confirm in the notes field if you only use auto updates.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh