A6.5.1: Are application updates applied automatically?
Are all updates applied on your applications by enabling auto updates?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
Answer Yes to A6.5.1 if automatic updates are enabled for applications wherever possible: browsers, Microsoft 365 Apps, PDF readers, collaboration tools and mobile apps. Applications that cannot update themselves need a managed process, described in A6.5.2. Either way, critical and high-risk application fixes must be installed within 14 days of release.
Is A6.5.1 an automatic fail?
No. A6.5.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- Most devices have the option to enable auto updates. Auto updates should be enabled where possible.
- Requirement enforced
All software on in-scope devices must have automatic updates enabled where possible.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A6.5AUTO-FAILA6.5.2Back to the security update management control
What does A6.5.1 ask?
A6.5.1 asks: “Are all updates applied on your applications by enabling auto updates?”
A6.5.1 asks whether all updates are applied on your applications by enabling auto updates. The guidance says auto updates should be enabled where possible.
The requirement is the same as for operating systems: all software on in-scope devices must have automatic updates enabled where possible. Many applications only apply an update after restarting, so the setting alone is not proof. Where you use a deployment tool or patch catalogue instead, describe it in A6.5.2.
What must be true to answer Yes to A6.5.1?
You can answer Yes to A6.5.1 only when all of the following are true today, across every device, user and cloud service in scope.
- Browsers, Microsoft 365 Apps or other office suites, PDF readers and collaboration clients update automatically.
- Mobile apps update automatically from the app stores.
- Applications that cannot auto-update are covered by A6.5.2.
- You can show current versions in an inventory or management report.
Why do applicants fail A6.5.1?
A common reason applicants fail A6.5.1: applications installed by users outside management, which nothing updates.
- Browsers that update but never restart.
- Runtimes such as Java or .NET with auto-update disabled.
- Answering Yes when line-of-business software is updated manually.
How do you fix a failing A6.5.1 answer?
If your answer to A6.5.1 would not pass today, fix the control first and then write the answer. In order:
- Turn on auto-update for every application that supports it, enforced by policy.
- Make sure updates are applied, for example by setting browser relaunch deadlines.
- Describe applications that cannot auto-update in A6.5.2.
How do assessors check A6.5.1?
What evidence should you keep for A6.5.1?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A6.5.1:
- The application auto-update policies, such as browser and Microsoft 365 Apps update settings.
Where to go next
- Microsoft Intune setupSetup guide
- Google ChromeSupport dates
- Patch managementGlossary
- Is it supported?Check a product's support status
- CE Plus test 2: authenticated patch scanHow the 14-day rule is tested
- Security Update Management requirementsThe control this question tests
- All A6 questionsSecurity update management
- Cyber Essentials checklistThe evidence to gather for every question
Other A6 questions
- A6.4.2A6.4.2NotesWhere auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all operating systems and firmware on firewalls and routers are applied…Notes
- A6.5A6.5Auto-failAre all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release?Auto-fail
- A6.5.2A6.5.2NotesWhere auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all software are applied within 14 days of release?Notes
- A6.6A6.6Yes/NoHave you removed any software installed on your devices that is no longer supported and no longer receives regular updates or vulnerability fixes for security problems?Yes/No
Frequently asked questions
A6.5.1 in the 2026 Danzell Cyber Essentials question set asks: "Are all updates applied on your applications by enabling auto updates?" It is a Yes/No question.
Answer Yes to A6.5.1 if automatic updates are enabled for applications wherever possible: browsers, Microsoft 365 Apps, PDF readers, collaboration tools and mobile apps. Applications that cannot update themselves need a managed process, described in A6.5.2. Either way, critical and high-risk application fixes must be installed within 14 days of release.
No. A6.5.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Where possible. If an application cannot update automatically, describe in A6.5.2 how its critical and high-risk fixes are installed within 14 days.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh