In short: The Cyber Essentials patching requirements say all in-scope software must be licensed and supported, with automatic updates on where possible. Updates fixing critical or high-risk vulnerabilities (vendor-rated, CVSS v3 score 7 or above, or unrated) must be installed within 14 days of release. Unsupported software must be removed or isolated from the internet.
What counts as software, and what 'supported' means
The Security Update Management control applies to servers, desktops, laptops, tablets, phones, firewalls and routers, and to cloud services. 'Software' is defined broadly: operating systems, off-the-shelf applications, browser extensions, interpreters, scripts, libraries, network software, and firewall and router firmware.
All of it must be:
- Licensed: you have a legal right to use it
- Supported: a vendor has committed to providing regular vulnerability fixes and has published the date those fixes will stop. The vendor need not be the original author, but must be able to change the software to produce fixes
Software that no longer meets this test must be removed from the device, or removed from scope by placing it in a defined sub-set that blocks all traffic to and from the internet. Automatic updates should be switched on wherever the software allows it.
The 14-day rule
Updates must be applied within 14 days of release when any of these is true:
| Trigger | Example |
|---|---|
| The vendor describes the fix as critical or high risk | A browser update the vendor labels critical |
| The vulnerability has a CVSS v3 base score of 7 or above | An operating system patch for a flaw scored 8.1 |
| The vendor gives no severity information at all | A firmware release with no security notes |
Two details matter. First, if a vendor bundles several fixes of different severity into one update, and any of them is critical or high risk, the whole update falls under the 14-day rule. Second, 'vulnerability fixes' are not only patches: registry changes, configuration changes, scripts or any other mechanism the vendor approves all count.
The NCSC also recommends, but does not require, installing every released update within 14 days. Fourteen days is a maximum, not a target; the sooner, the better.
Danzell: patching questions are now automatic fails
Under the Danzell question set used since 27 April 2026, the questions asking whether critical and high-risk updates are installed within 14 days became automatic fails. They cover:
- Operating systems, and router and firewall firmware
- Applications, including browsers, office software, plug-ins and other third-party software
A 'no' to either ends the assessment, regardless of how well the rest of your answers score. Unsupported software in scope was already an automatic fail. Read more about the Danzell question set and why organisations fail Cyber Essentials.
Unsupported software to look out for
The most common problem is not a missed patch but software that will never be patched again. Examples current in late 2026:
- Windows 10 reached end of support on 14 October 2025. Devices are only acceptable if enrolled in Microsoft's Extended Security Updates; see Windows 10 and Cyber Essentials
- Office 2016 and Office 2019, and Exchange Server 2016 and 2019, also reached end of support on 14 October 2025
- Windows Server 2016 leaves extended support on 12 January 2027, so servers still running it need a plan now
- Windows 10 Enterprise LTSC 2021 also reaches end of support on 12 January 2027
- Older phones and tablets that no longer receive operating system security updates from the manufacturer
- Routers, firewalls and NAS devices whose manufacturer has stopped releasing firmware
- Old runtimes, plug-ins and browser extensions nobody remembers installing
Building a patching routine that holds up
A reliable process matters more than any single tool:
- Keep an accurate inventory of devices and installed software, ideally from device management rather than a spreadsheet
- Turn on automatic updates for operating systems, browsers and office apps, and use update rings so a small pilot group gets updates first
- Cover third-party applications as well as the operating system; these are where the 14-day rule is most often missed
- Schedule firmware checks for routers, firewalls, switches, access points and storage devices
- Review compliance reports weekly and chase any device that has not checked in
- Remove or replace anything approaching end of support before the date arrives
Tools such as Microsoft Intune update rings or Windows Autopatch make the Windows side largely automatic; third-party apps and firmware need someone to own them.
How Cyber Essentials Plus tests patching
At Cyber Essentials Plus, test case 2 checks patching with an authenticated vulnerability scan of a sample of end-user devices, servers and infrastructure-as-a-service instances. If the scan finds a critical or high-risk vulnerability (vendor-rated, CVSS v3 7 or above, or unrated) whose fix has been available for more than 14 days, the test fails. The test specification also makes clear that virtual patching is not an acceptable long-term answer for legacy, unsupported operating systems. See Cyber Essentials Plus vulnerability scans for how to prepare.
How we help
We identify unsupported software across your estate, set up automatic and managed patching through Intune or your existing tools, cover third-party apps and firmware, and report on 14-day compliance so you can answer the patching questions with confidence. Our Cyber Essentials gap analysis is the usual starting point.
Contact us about managed patching, or go back to the Cyber Essentials requirements overview.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the 14-day rule in Cyber Essentials?
Updates that fix critical or high-risk vulnerabilities must be installed within 14 days of release. That covers fixes the vendor rates critical or high, vulnerabilities with a CVSS v3 score of 7 or above, and updates where the vendor gives no severity information.
Does the 14-day rule apply to every update?
Only to critical and high-risk fixes, or unrated ones. The NCSC strongly recommends applying all updates within 14 days, but for other updates this is advice rather than a requirement.
Does firmware count for Cyber Essentials patching?
Yes. Router and firewall firmware is explicitly included in the definition of software, and under the Danzell question set late firmware updates on those devices are an automatic fail.
Can I keep unsupported software if it is not connected to the internet?
Only by removing it from scope in a defined sub-set that blocks all traffic to and from the internet. Otherwise unsupported software must be removed, and leaving it in scope fails the assessment.
What if the vendor has not released a fix yet?
The 14-day clock starts when a fix is released. Until then, apply any vendor-approved workaround, such as a configuration change, because these count as vulnerability fixes too, and keep a note of what you did.