A6.5.2: How do you meet 14 days for applications without auto-update?
Where auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all software are applied within 14 days of release?
Source: IASME Cyber Essentials Danzell question set v16.3
A compliant A6.5.2 answer explains how critical and high-risk fixes for applications that do not auto-update are installed within 14 days of release: the tool, the owner, how releases are tracked and how you confirm installation. If every application auto-updates, say so in the notes. Include extensions, runtimes and line-of-business software.
Is A6.5.2 an automatic fail?
No. A6.5.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- It is not always possible to apply auto updates, this is often the case when you have critical systems or software and you need to be in control of the updating process. Please describe how any updates and vulnerability fixes are applied when auto updates are not configured.
- Requirement enforced
All software on in-scope devices must be updated, including vulnerability fixes, within 14 days of release, where:
- The update fixes vulnerabilities described by the vendor as ‘critical’ or ‘high-risk’
- The update addresses vulnerabilities with a CVSSv3 base score of 7 or above
- There are no details of the level of vulnerabilities the update fixes provided by the vendor
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A6.5.1A6.6Back to the security update management control
What does A6.5.2 ask?
A6.5.2 asks: “Where auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all software are applied within 14 days of release?”
A6.5.2 asks how, where auto updates are not used, you ensure all high-risk or critical security updates and vulnerability fixes for all software are applied within 14 days of release. The guidance says this is often the case for critical systems or software where you need control of the process, and asks you to confirm in the notes if you only use auto updates.
The same three triggers apply as for operating systems: vendor-rated critical or high risk, CVSS v3 7 or above, or no severity given. Third-party patch catalogues in Intune, RMM tools and package managers are the usual ways to meet it. See the Java and Adobe Acrobat Reader pages for two applications that often fall behind.
What should you write in the notes field for A6.5.2?
Write two to four specific sentences for A6.5.2: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
Applications that do not auto-update ([line-of-business app], [Java runtime], [n other]) are patched by [role / MSP] through [Intune Enterprise App Management / RMM third-party patching / winget]. [Role] checks vendor advisories [weekly] and deploys critical and high-risk updates within [7] days of release. The [RMM / Intune] software inventory report is reviewed [weekly]; any device more than 14 days behind is fixed or isolated. All other applications use automatic updates (A6.5.1).
Why do applicants fail A6.5.2?
A common reason applicants fail A6.5.2: no process for applications installed outside the deployment tool.
- Line-of-business software updated only when the vendor visits.
- No inventory, so nobody knows which versions are installed.
- Leaving it blank when everything auto-updates, instead of confirming that.
How do you fix a failing A6.5.2 answer?
If your answer to A6.5.2 would not pass today, fix the control first and then write the answer. In order:
- List the applications that do not auto-update.
- Patch them through a deployment tool or patching catalogue with an owner and a timetable under 14 days.
- Review the software inventory report weekly and fix anything behind.
- If everything auto-updates, say so in the notes.
How do assessors check A6.5.2?
What evidence should you keep for A6.5.2?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A6.5.2:
- The patching procedure for applications that do not auto-update, and recent deployment records.
Where to go next
- Java supportSupport dates
- Adobe Acrobat ReaderSupport dates
- Patch managementGlossary
- Is it supported?Check a product's support status
- CE Plus test 2: authenticated patch scanHow the 14-day rule is tested
- Security Update Management requirementsThe control this question tests
- All A6 questionsSecurity update management
- Cyber Essentials checklistThe evidence to gather for every question
Other A6 questions
- A6.5A6.5Auto-failAre all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release?Auto-fail
- A6.5.1A6.5.1Yes/NoAre all updates applied on your applications by enabling auto updates?Yes/No
- A6.6A6.6Yes/NoHave you removed any software installed on your devices that is no longer supported and no longer receives regular updates or vulnerability fixes for security problems?Yes/No
- A6.7A6.7NotesWhere you have a business need to use unsupported software, have you moved the devices and software out of scope of this assessment? Please explain how you achieve this.Notes
Frequently asked questions
A6.5.2 in the 2026 Danzell Cyber Essentials question set asks: "Where auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all software are applied within 14 days of release?" It is a notes question, answered in free text.
A compliant A6.5.2 answer explains how critical and high-risk fixes for applications that do not auto-update are installed within 14 days of release: the tool, the owner, how releases are tracked and how you confirm installation. If every application auto-updates, say so in the notes. Include extensions, runtimes and line-of-business software.
No. A6.5.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Yes. A6.5 covers software including any associated files and extensions, and v3.3 lists extensions in its definition of software.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh