The patch management statement
The update section carries three automatic fails, and this short statement is the written side of meeting them: supported software only, and high-risk, critical and unrated security updates on within 14 days, with automatic updates doing the work. The same statement ReadyCert drafts, free to take.
Your patch management statement
The .md file opens in Word, Google Docs and Notion. Nothing leaves your browser.
Patch Management Statement — Your company
Adopted today.
All our devices run operating systems that still receive security updates from their makers. Automatic updates are switched on for our operating systems and applications wherever they offer it.
Our commitment: high-risk and critical security updates — and any security update the maker hasn't given a rating — are installed within 14 days of release, across operating systems, applications, browsers and the firmware on our router/firewall. Automatic updates do most of this for us; anything that can't auto-update is checked and updated promptly by hand.
Software that stops being supported gets updated, replaced, or removed — it doesn't linger on our machines.
What this statement commits you to
Two things, both checked by the questionnaire. First, everything in scope runs software its maker still updates — an unsupported operating system anywhere is an automatic fail (A6.1). Second, security updates rated high-risk or critical — and any the vendor doesn’t rate — are installed within 14 days of release, across operating systems, applications, browsers and the firmware on your router or firewall — and “no” to that is an automatic fail too (A6.4, A6.5). The statement also records the honest mechanism: automatic updates on, with anything that cannot auto-update checked and patched by hand. The 14-day rule guide covers what counts and why monthly cycles miss.
Adopt it only when it is true
- Switch on automatic updates everywhere first — Windows, macOS, phones, browsers, and the router if it offers it. The statement describes reality, not intention.
- Deal with anything unsupported. If a device is on a retired operating system, this statement cannot honestly be adopted until it is upgraded, replaced or removed — see the unsupported software guide.
- Name it, date it, keep it findable. The generator above fills both in. At renewal, re-read it: it should still be true without edits.
Frequently asked questions
Does Cyber Essentials require a written patch management policy?
The questionnaire asks how updates are applied and whether high-risk ones always land within 14 days. A short written statement is the cleanest way to answer consistently — and to keep the answer true year to year.
What must the statement commit to?
That everything in scope runs supported software, and that high-risk or critical security updates — and any the vendor doesn’t rate — are installed within 14 days of release — across operating systems, applications, browsers and router/firewall firmware. Automatic updates are how a small business honestly meets it.
Can I adopt this statement if updates are currently manual and monthly?
Not honestly — a monthly cycle can miss the 14-day window, which is an automatic fail (questions A6.4 and A6.5). Switch on automatic updates first, then adopt the statement it describes.