Cyber Essentials patching and security update requirements (the 14-day rule)
Cyber Essentials security update management: licensed and supported software, auto-updates, and critical or high-risk fixes within 14 days. Includes the Danzell auto-fail rules for A6.4 and A6.5.
All in-scope software must be licensed and supported, set to auto-update where possible, and have critical or high-risk fixes (CVSS v3 7.0 or above, or unrated) installed within 14 days of release. Unsupported software must be removed or moved into a sub-set with no internet access.
- Aim
- Ensure that devices and software are not vulnerable to known security issues for which fixes are available.
- Applies to
- Servers, desktop computers, laptops, tablets, mobile phones, firewalls, routers, IaaS, PaaS, SaaS
- Questions
- A6.1A6.2A6.2.1A6.2.2A6.2.3A6.2.4A6.3A6.3.1A6.4AUTO-FAILA6.4.1A6.4.2A6.5AUTO-FAILA6.5.1A6.5.2A6.6A6.7
- What changed in 2026
- The requirement text is unchanged in v3.3. In the Danzell question set a No to A6.4 or A6.5 (critical or high-risk updates within 14 days) is an automatic fail, as the guidance for each states. A6.3 and A6.6 (unsupported software in scope) carry no fail wording, but a non-compliant answer means the licensed-and-supported requirement is not met. The A6.1 guidance names Windows 10 as end of life from 14 October 2025 unless enrolled in Extended Security Updates.
What does Cyber Essentials require for security update management?
The Cyber Essentials security update management control is the requirement that all in-scope software is licensed and supported, and that critical and high-risk security updates are installed within 14 days of release.
Any device that runs software can contain vulnerabilities, and attackers move quickly to exploit them once they are public. Vendors fix the ones they know about in supported products through patches, security updates, registry fixes, scripts, configuration changes or any other mechanism they prescribe.
This control applies to servers, desktop computers, laptops, tablets, mobile phones, firewalls, routers, IaaS, PaaS and SaaS. Firewall and router firmware is treated as an operating system.
Does all software have to be licensed and supported?
be licensed and supported
Yes. Licensed and supported software is software you have a legal right to use and that a vendor has committed to support by providing regular vulnerability fixes, with a published date for when that support ends. Free and open-source software is fine if you comply with its licence.
A6.1 covers operating systems (including firewall and router firmware), A6.2 covers applications, and A6.2.1 to A6.2.4 ask you to list browsers, anti-malware, email clients and office applications with versions. A6.3 asks the direct question: is any in-scope software or cloud service unlicensed or unsupported? A Yes is not labelled an automatic fail, but it means the requirement is not met, and the application will not pass until the software is removed or moved out of scope.
Watch for subscriptions. The A6.3 guidance warns that for some operating systems, firmware and applications, security updates stop if the annual licence is not renewed. Firewall firmware support contracts and per-year software subscriptions are the usual cases, so check renewal dates against your submission date. The A6.2.1 to A6.2.4 lists need versions, in the form the guidance shows: 'Chrome Version 124', 'Outlook 2019', 'Office 2016'.
What happens to software when it goes out of support?
be removed from devices when it becomes unsupported, or removed from scope by using a defined sub-set that prevents all traffic to or from the internet
Two options only. Remove it, or move the devices running it into a defined sub-set, segregated by a firewall or VLAN, that prevents all traffic to or from the internet. A6.6 asks whether you have removed unsupported software; A6.7 asks how you have segregated anything you must keep. A No to A6.6 is not labelled an automatic fail, but it means the requirement is not met and the assessor will not pass the application.
The sub-set route has a consequence for the certificate. The A6.7 guidance says that if the out-of-scope sub-set remains connected to the internet you cannot achieve whole company certification and must select 'Partial Organisation' at A2.1. Where you have no unsupported software anywhere, declare that in A6.7.
An extended security update programme keeps an operating system supported for as long as you hold the subscription. Windows 10 after 14 October 2025 is the common case: the A6.1 guidance says you must be signed up to Microsoft's Extended Security Update programme to remain compliant, and that for any end-of-life operating system with such a programme you must maintain the required subscription. Microsoft's ESU documentation says the commercial programme is bought by year, for a maximum of three years after end of support, that devices must run Windows 10 version 22H2, and that joining in a later year means paying for the earlier years too. Confirm the subscription covers the date you submit and that every Windows 10 device in A2.6 is enrolled.
The A6.1 guidance gives Windows XP, Vista, Server 2003, Windows 10, macOS Ventura, iOS 15, Android 12 and Ubuntu 17.10 as examples of operating systems out of regular support, and says to check with the vendor rather than rely on the list. The Is it supported? tool and the end of support glossary entry help you check each version in your inventory.
Do automatic updates have to be enabled?
have automatic updates enabled where possible
Where possible, yes. A6.4.1 asks whether operating system updates are applied by auto-update and A6.5.1 asks the same for applications. Where you deliberately manage updates through a tool instead (Intune rings, WSUS, an RMM), A6.4.2 and A6.5.2 ask how you make sure the 14-day window is still met. If you rely only on auto-updates, the guidance asks you to say so in those notes fields rather than leave them blank.
What is the 14-day rule for security updates?
be updated, including vulnerability fixes, within 14 days of release
Software on in-scope devices must be updated, including vulnerability fixes, within 14 days of release where the update fixes vulnerabilities described by the vendor as 'critical' or 'high risk', where it addresses vulnerabilities with a CVSS v3 base score of 7 or above, or where the vendor provides no details of the level of vulnerabilities fixed.
If a single update covers several issues and any of them is critical or high risk, the whole update must be installed within 14 days. The NCSC recommends, but does not mandate, applying all updates within 14 days. A6.4 covers operating systems and firmware, A6.5 covers applications, associated files and extensions. Under Danzell a No to either is an automatic fail.
QuestionsA6.4AUTO-FAILA6.5AUTO-FAIL
How does Cyber Essentials Plus test security update management?
Cyber Essentials Plus tests security update management through Test case 2: Check patching, by authenticated vulnerability scan of devices in the Test Specification v3.2. The steps, paraphrased:
- Each sampled end user device, server and IaaS instance is scanned with a Delivery Partner approved tool using credentials.
- The assessor picks out vulnerabilities that the vendor calls critical or high risk, that have a CVSS v3 base score of 7 or above, or where the vendor gives no severity.
- If any such vulnerability has a vendor fix that has been available for more than 14 days, the sub-test fails.
- Virtual patching is not accepted as a long-term mitigation for unsupported operating systems.
Who is responsible for security update management in cloud services?
For IaaS and PaaS you share update responsibility with the provider: they patch the hypervisor or platform, you patch the guest operating system and your applications. For SaaS the provider implements the control, but the service must still be supported and you must be able to evidence that.
| Requirement | IaaS | PaaS | SaaS |
|---|---|---|---|
| Firewalls | Both your organisation and the cloud provider | The cloud provider and sometimes also your organisation | The cloud provider |
| Secure Configuration | Both your organisation and the cloud provider | Both your organisation and the cloud provider | Both your organisation and the cloud provider |
| Security Update Management | Both your organisation and the cloud provider | Both your organisation and the cloud provider | The cloud provider |
| User Access Control | Your organisation | Your organisation | Your organisation |
| Malware Protection | Both your organisation and the cloud provider | The cloud provider and sometimes also your organisation | The cloud provider |
The applicant is always responsible for ensuring all controls are implemented. Where the provider implements one on your behalf, the commitment must be in contractual clauses or documents referenced by contract. See cloud services scope.
Which questions cover security update management?
16 Danzell questions cover security update management, A6.1 to A6.7. A6.4, A6.5 are automatic fails: a No to A6.4 or A6.5 fails the assessment outright. Each links to the exact wording and a model answer.
- A6.1A6.1Yes/NoAre all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes?Yes/No
- A6.2A6.2Yes/NoIs all the software on your devices supported by a supplier that produces regular vulnerability fixes for any security problems?Yes/No
- A6.2.1A6.2.1NotesPlease list your internet browser(s).Notes
- A6.2.2A6.2.2NotesPlease list your malware protection softwareNotes
- A6.2.3A6.2.3NotesPlease list your email applications installed on end user devices and servers.Notes
- A6.2.4A6.2.4NotesPlease list all office applications that are used to create organisational data.Notes
- A6.3A6.3Yes/NoAre any of the in-scope software or cloud services unlicensed or unsupported?Yes/No
- A6.3.1A6.3.1NotesIf yes to A6.3, please list the unsupported or unlicensed software or cloud services.Conditional: if yes to A6.3Notes
- A6.4A6.4Auto-failAre all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?Auto-fail
- A6.4.1A6.4.1Yes/NoAre all updates applied for operating systems by enabling auto updates?Yes/No
- A6.4.2A6.4.2NotesWhere auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all operating systems and firmware on firewalls and routers are applied…Notes
- A6.5A6.5Auto-failAre all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release?Auto-fail
- A6.5.1A6.5.1Yes/NoAre all updates applied on your applications by enabling auto updates?Yes/No
- A6.5.2A6.5.2NotesWhere auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all software are applied within 14 days of release?Notes
- A6.6A6.6Yes/NoHave you removed any software installed on your devices that is no longer supported and no longer receives regular updates or vulnerability fixes for security problems?Yes/No
- A6.7A6.7NotesWhere you have a business need to use unsupported software, have you moved the devices and software out of scope of this assessment? Please explain how you achieve this.Notes
How do assessors check security update management?
Related requirements
- Previous control: Secure ConfigurationEnsure that computers and network devices are properly configured to reduce vulnerabilities and provide only the services required to fulfil their role.
- Next control: User Access ControlEnsure that user accounts are assigned to authorised individuals only, and provide access to only those applications, computers and networks that the user needs to carry out their role.
- A6.4: critical updates within 14 daysThe flagship question, and an auto-fail
- Security update questions A6.1 to A6.7Every A6 question explained
- Is it supported? toolCheck an OS or application's support status
- CE Plus test 2: authenticated patch scanHow missing patches are found
- Glossary: sub-setHow to segregate unsupported systems
- Glossary: CVSSThe scoring system behind the 7.0 threshold
- Microsoft Intune setup guideUpdate rings that meet the 14-day rule
- Cyber Essentials checklistEvery requirement as a row with the evidence to gather
- Check your readinessTest your answers against the auto-fail questions first
Frequently asked questions
Yes. The control applies to firewalls and routers, and A6.4 states that firmware on firewalls and routers is considered an operating system. Critical or high-risk firmware fixes must be installed within 14 days of release, which usually means an explicit process because network devices rarely auto-update.
For Cyber Essentials, critical or high-risk vulnerabilities are those with a CVSS v3 base score of 7 or above, or those the vendor identifies as critical or high risk. If the vendor gives no severity at all, the update must also be installed within 14 days.
Only with Extended Security Updates. The A6.1 guidance says that if you are using Windows 10 beyond 14 October 2025 you must be signed up to the Microsoft Extended Security Update programme to remain compliant, and that you must maintain the required subscription. Without a current subscription, Windows 10 is unsupported software in scope, so the licensed-and-supported requirement is not met and the application will not pass.
No. A6.4 and A6.5 guidance says you are not required to install feature updates or optional updates to meet the requirement, only high-risk or critical security updates and vulnerability fixes. Feature updates still matter because an old feature version eventually leaves support.
The requirement allows no exceptions inside scope. Your options are to remove the software, or to move the affected devices into a sub-set segregated by a firewall or VLAN that prevents all traffic to or from the internet, and describe that in A6.7. A6.4 guidance is explicit that if you cannot meet the 14 days at all times you will not achieve compliance.
Two in section A6: A6.4 (critical or high-risk OS and firmware updates within 14 days) and A6.5 (the same for applications). The guidance for each says a No will be an automatic fail. A6.3 (unlicensed or unsupported software in scope) and A6.6 (unsupported software removed) carry no fail wording, but a non-compliant answer to either means the requirement is not met.
Yes. Mobile phones and tablets are in the applies-to list for security update management, including BYOD that reaches organisational data. The A6.1 guidance names iOS 15 and Android 12 as examples of operating systems out of regular support. A phone that no longer receives security updates from its vendor must be replaced or kept away from organisational data and services.
The requirement is 14 days of release and makes no exception for weekends or holidays, so plan for 14 calendar days. The A6.4 guidance says 14 days is considered a reasonable period, that any longer would be a serious security risk, and that updates should be applied as soon as possible.
A software inventory with versions for browsers, anti-malware, email clients and office applications (A6.2.1 to A6.2.4), the auto-update or patch policy for operating systems and applications (A6.4.1, A6.5.1), a recent patch compliance report showing nothing critical or high older than 14 days, firewall and router firmware versions, and any ESU subscription record.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials Plus Test Specification v3.2Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026Read on iasme.co.uk (opens in a new tab)
- NCSCNCSC, Keeping devices and software up to dateRead on ncsc.gov.uk (opens in a new tab)
- learn.microsoft.comMicrosoft Learn, Extended Security Updates (ESU) program for Windows 10Read on learn.microsoft.com (opens in a new tab)