Security updates: the control that now fails you outright

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

The two Danzell automatic-fail questions

In April 2026, the NCSC and IASME tightened how security updates are marked (IASME). Two assessment questions — covering operating systems and router/firewall firmware, and applications including their associated files and extensions — are now automatic-fail questions. If you cannot confirm that critical and high-risk updates are installed within 14 days across your in-scope devices, your application fails immediately.

The four core rules in Requirements v3.3

Section E.3 of the NCSC Requirements for IT Infrastructure v3.3 (pages 16–18) states that all software on in-scope devices (operating systems, commercial applications, extensions, interpreters, scripts, libraries, and router/firewall firmware) must:

1. Be licensed and supported: You must have a legal right to use the software, and the vendor must still be committed to providing regular vulnerability fixes with a published future end-of-support date.
2. Be removed or segregated when unsupported: Once software reaches end of support, you must uninstall it or move the device into a defined, segregated network sub-set (behind a firewall or VLAN) that blocks all traffic to and from the internet.
3. Have automatic updates enabled where possible: Turn on automatic patching for Windows, macOS, iOS, Android, browsers and office suites so fixes do not wait for manual intervention.
4. Be updated within 14 days of release for critical and high-risk fixes: The 14-day mandatory window applies to patches, registry fixes, configuration changes or vendor-prescribed workarounds.

What counts as “critical” or “high risk”?

Under v3.3 (page 17), an update falls under the mandatory 14-day rule if any of these three conditions apply:

• The vendor describes the vulnerability it fixes as “critical” or “high risk”.
• The vulnerability has a Common Vulnerability Scoring System (CVSS) v3 base score of 7.0 or above.
• The vendor provides no severity details at all for the vulnerabilities fixed by the update.

In addition, if a vendor bundles fixes for several issues of different severities into a single cumulative update (as Microsoft, Apple and Google routinely do) and any issue inside that bundle is critical or high risk, the whole update must be installed within 14 days.

“Point in time” means the certificate issue date

IASME’s April 2026 update clarifies a point that previously caught applicants out: Cyber Essentials is a “point in time” assessment, and that point in time is the date the certificate is issued (not the day you opened your assessment account). Every operating system and application in scope must still be supported on the day your certificate is awarded.

Real examples: Windows 10 and Office 2016, 2019 and 2021

Major Microsoft products have recently reached the end of standard support:

• Windows 10: Reached the end of free support on 14 October 2025. Any Windows 10 PC in your scope will fail Cyber Essentials unless it is enrolled in Microsoft’s paid commercial Extended Security Updates (ESU) programme (or runs in Windows 365 / Azure Virtual Desktop where ESU is included) and installs those updates within 14 days. Note that Microsoft’s consumer ESU option is not valid for commercial/domain-joined devices.
• Office 2016, Office 2019 and Office 2021: Office 2016 and 2019 reached end of support on 14 October 2025, and Office 2021 reached end of support on 13 October 2026, with no Extended Security Updates offered. They must be uninstalled and replaced with supported Microsoft 365 Apps or Office 2024 before you apply.

Read our detailed guides on unsupported software and the 14-day patching rule.