How Do Security Updates Work for Cyber Essentials?

How Do Security Updates Work for Cyber Essentials?

Last updated: 3 October 2026

Security update management means keeping every piece of software and firmware patched, so attackers cannot use known flaws to get in. Most successful attacks use weaknesses that already have a fix available.

It is the third of the five Cyber Essentials technical controls from the National Cyber Security Centre (NCSC), and the 14-day rule is one of the most common reasons for a failed assessment.

What Cyber Essentials requires

• All operating systems, apps, routers and firewalls must be licensed and still supported by the vendor.
• Automatic updates switched on wherever the software allows it.
• High-risk and critical security updates installed within 14 days of release.
• Unsupported software removed from the network, or isolated so it is out of scope.
• This covers laptops, servers, phones and tablets, and network equipment such as routers and firewalls.

Where businesses most often slip up

• Windows 10 devices that are no longer receiving security updates (support ended in October 2025 unless Extended Security Updates are in place).
• Router or firewall firmware that has not been updated for years.
• Laptops that are rarely switched on, so updates never install.
• Third-party apps such as browsers, PDF readers and remote tools that nobody keeps patched.

How ABCOM helps

ABCOM manages patching for our clients automatically, tracks the 14-day window, and reports on anything that is falling behind or no longer supported. Before an assessment we run a full check so there are no surprises.

This is one of the five Cyber Essentials technical controls. Not sure whether your business would pass? Take our free 4-minute readiness quiz, or book a free cyber security review.