A6.5: Are critical and high-risk application updates installed within 14 days?
Are all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
To answer Yes to A6.5 every high-risk or critical security update and vulnerability fix for software, including associated files and extensions, must be installed within 14 days of release on every device in scope, in all circumstances. Under the Danzell question set a No is an automatic fail. Feature and optional updates are not required.
Is A6.5 an automatic fail?
Yes. A6.5 is one of the four questions in the 2026 Danzell question set that fail automatically on a No answer (A6.4, A6.5, A7.16 and A7.17): answering No fails the whole Cyber Essentials assessment, whatever the other answers say.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- You must install any such updates and vulnerability fixes within 14 days in all circumstances. If you cannot achieve this requirement at all times, you will not achieve compliance to this question.
- Requirement enforced
All software on in-scope devices must be updated, including vulnerability fixes, within 14 days of release, where:
- The update fixes vulnerabilities described by the vendor as ‘critical’ or ‘high-risk’
- The update addresses vulnerabilities with a CVSSv3 base score of 7 or above
- There are no details of the level of vulnerabilities the update fixes provided by the vendor
- Outcome if non-compliant
- Automatic fail on a No answer under the Danzell question set
- Related questions
- A6.4.2A6.5.1Back to the security update management control
What does A6.5 ask?
A6.5 asks: “Are all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release?”
A6.5 is the application counterpart of A6.4. It asks whether all high-risk or critical security updates and vulnerability fixes for software, including any associated files and extensions, are installed within 14 days of release. The guidance repeats that you must do this in all circumstances and that No is an automatic fail.
Software in the requirements includes operating systems, commercial off-the-shelf applications, extensions, interpreters, scripts, libraries, network software and firewall and router firmware. For A6.5 that means browsers and their extensions, office suites, PDF readers, collaboration clients, VPN clients, runtimes such as Java and .NET, and anything else installed on in-scope devices.
A6.5.1 asks whether application updates are applied by auto-update; A6.5.2 asks how you meet the 14 days where they are not.
What must be true to answer Yes to A6.5?
You can answer Yes to A6.5 only when all of the following are true today, across every device, user and cloud service in scope.
- Every application on in-scope devices either auto-updates (A6.5.1) or is covered by a managed deployment that meets 14 days from release (A6.5.2).
- Browser extensions, plug-ins and runtimes are included, not only the applications you list in A6.2.1 to A6.2.4.
- Software that no longer receives updates has been removed (A6.6) rather than left installed.
- A compliance or inventory report shows current versions across the estate.
Why do applicants fail A6.5?
A common reason applicants fail A6.5: applications installed outside the deployment tool that nothing updates: a one-off PDF tool, an old Java runtime, a line-of-business client.
- Browsers that auto-update but are never restarted, so the update is downloaded but not applied.
- Extensions and plug-ins forgotten because the question set only asks for browser and office versions.
- An A6.2.1 to A6.2.4 list showing versions that are months old, contradicting the Yes.
How do you fix a failing A6.5 answer?
If your answer to A6.5 would not pass today, fix the control first and then write the answer. In order:
- Turn on auto-update for browsers, office suites, PDF readers and collaboration clients.
- Cover other applications with a third-party patching catalogue in your MDM or RMM.
- Remove applications nothing updates, old runtimes and unmaintained browser extensions.
- Check versions on the day you submit and fix anything more than 14 days behind on a critical or high-risk fix.
How do assessors check A6.5?
What evidence should you keep for A6.5?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A6.5:
- An application inventory with versions, and the third-party patching report if you use one.
Where to go next
- The 14-day rule in practicePatching that meets the deadline
- Browser extensionGlossary
- Java supportSupport dates
- Is it supported?Check a product's support status
- CE Plus test 2: authenticated patch scanHow the 14-day rule is tested
- Security Update Management requirementsThe control this question tests
- All A6 questionsSecurity update management
- Cyber Essentials checklistThe evidence to gather for every question
Other A6 questions
- A6.4.1A6.4.1Yes/NoAre all updates applied for operating systems by enabling auto updates?Yes/No
- A6.4.2A6.4.2NotesWhere auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all operating systems and firmware on firewalls and routers are applied…Notes
- A6.5.1A6.5.1Yes/NoAre all updates applied on your applications by enabling auto updates?Yes/No
- A6.5.2A6.5.2NotesWhere auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all software are applied within 14 days of release?Notes
Frequently asked questions
A6.5 in the 2026 Danzell Cyber Essentials question set asks: "Are all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release?" It is a Yes/No question.
To answer Yes to A6.5 every high-risk or critical security update and vulnerability fix for software, including associated files and extensions, must be installed within 14 days of release on every device in scope, in all circumstances. Under the Danzell question set a No is an automatic fail. Feature and optional updates are not required.
Yes. The guidance says this will be an automatic fail if the answer is no, in line with A6.4. The two 14-day questions are the automatic fails in the security update management section.
All software on in-scope devices: commercial applications, extensions, interpreters, scripts, libraries and network software. The question itself says 'including any associated files and extensions', so browser extensions and plug-ins are in.
Yes, and auto-update is the recommended approach (A6.5.1). Make sure the update is actually applied: browsers download updates in the background but apply them on restart, so a laptop left running for a month can be weeks behind.
It is unsupported and must be removed from in-scope devices or moved into a sub-set with no internet access. A6.6 asks whether you have removed it. A No is a fail: IASME's FAQ says "any company using unsupported software in the scope of the assessment will fail to achieve Cyber Essentials certification".
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh