The 14-day rule: how Cyber Essentials expects you to handle updates

What the rule says

Security updates rated high-risk or critical — defined as a CVSS v3 base score of 7 or above, or simply labelled critical or high by the vendor — must be installed within 14 days of the vendor releasing them — and so must any security update where the vendor gives no severity rating. The questionnaire asks this twice: question A6.4 for operating systems and the firmware on your router or firewall, and A6.5 for applications. A “no” to either fails the assessment outright, however good everything else is.

The wording matters in two ways. First, the clock starts on the vendor’s publish date, not the day you notice. Second, “installed” means finished — an update sitting behind a “restart required” prompt for three weeks has not been installed.

What it covers — more than Windows

The rule reaches everything in scope that runs software: operating systems on laptops, desktops, phones and tablets; applications — office suites, accounting software, email clients, your anti-malware; browsers and their plug-ins and extensions; and the firmware on routers and firewalls. It also includes configuration changes a vendor recommends as part of a security fix. The parts people forget are the browser extensions nobody audits and the router that has never had a firmware update in its life.

Why monthly patching fails

A fixed monthly cycle sounds responsible, but the arithmetic is against it: a critical update published the day after your patch day waits nearly a month — double the allowed window. That is why the questionnaire follows up by asking whether automatic updates are switched on (A6.4.1). They must be on wherever a device or app offers them; a manual process is only for systems that can’t update automatically (A6.4.2, A6.5.2), and it still has to get important updates on within 14 days, every time, including when the person responsible is on holiday. For a business of five to fifty people, automatic updates are the only honest way to answer yes.

The settings that meet it

Windows

Start → Settings → Windows Update: make sure updates aren’t paused (click “Resume updates” if you see it), and under Advanced options turn on “Receive updates for other Microsoft products” — that covers older versions of Office; Microsoft 365 apps update themselves. Restart when Windows asks, so updates actually finish installing.

Mac

Apple menu → System Settings → General → Software Update: open the (i) next to Automatic updates and turn everything on — especially “Install Security Responses and system files”.

Browsers and apps

Chrome, Edge, Firefox and Safari update themselves — but only complete the update when fully closed and reopened, so do that now and then, and click any “Update” button a browser shows. Remove extensions you don’t use and let the rest update automatically. For other applications, turn on automatic updates in each app’s settings where offered, and install updates promptly when prompted.

Phones and tablets

Turn on automatic updates in Settings on iPhone, iPad and Android, and turn on automatic app updates in the App Store or Google Play settings too — that is a separate switch.

Routers and firewalls

Log into the admin page and turn on automatic firmware updates if the router offers them. If it doesn’t, set a reminder to check at least every two weeks, and act promptly whenever the maker announces a security fix. Firmware is explicitly inside the 14-day rule.

The other half: supported software

The 14-day rule assumes updates exist to install. Software the maker no longer updates cannot meet it, which is why an unsupported operating system anywhere in scope is its own automatic fail (A6.1) and unsupported applications must be updated, removed, or walled off. If you have anything old in the building, read the unsupported software guide first — it is the harder problem, because there is no setting that fixes it.

Answering the questions honestly

Before answering yes to A6.4 and A6.5, check rather than assume: pick two or three machines and look at when they last installed updates (Windows Update history, macOS Software Update). If automatic updates are on everywhere, devices restart when asked, and nothing in scope is unsupported, yes is the truthful answer — and the free-text box is the place to say exactly that: “automatic updates on for all devices and browsers; router firmware updates automatically (or is checked at least every two weeks and whenever the maker announces a security fix).” The checklist covers the whole section.