The 14-day patching rule

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

Two automatic-fail questions under Danzell

In its April 2026 scheme update, IASME designated two patching questions as automatic failures:

• Operating systems & firmware: High-risk or critical security updates and vulnerability fixes for operating systems (Windows, macOS, Linux, iOS, iPadOS, Android) and router/firewall firmware installed within 14 days of release.
• Applications & extensions: High-risk or critical security updates and vulnerability fixes for applications — including associated files, plugins and browser extensions — installed within 14 days of release.

Failing either question fails the entire assessment automatically.

When the 14-day clock starts — and what counts when a vendor gives no rating

The 14-day clock starts on the date the vendor publicly releases the update or vulnerability fix. Under Section E.3 of the NCSC Requirements for IT Infrastructure v3.3 (page 17), the 14-day rule applies whenever:

1. The vendor describes the vulnerability fixed as “critical” or “high risk”; OR
2. The vulnerability has a Common Vulnerability Scoring System (CVSS) v3 base score of 7.0 or above; OR
3. The vendor provides no severity details at all for the vulnerabilities fixed by the update.

Because many smaller software vendors and router manufacturers publish security updates with release notes that simply say “bug and security fixes” without a CVSS score, every unrated security update must be installed within 14 days.

What “applications” covers in practice

Section B of v3.3 (page 5) defines software broadly to include commercial off-the-shelf applications, extensions, interpreters, scripts and libraries. On a typical office laptop, that means:

• Web browsers and extensions: Microsoft Edge, Google Chrome, Firefox, and any password-manager or ad-blocker extensions installed in them.
• Office and PDF software: Microsoft 365 Apps (Word, Excel, Outlook), Adobe Acrobat Reader, Foxit.
• Communication and utilities: Microsoft Teams, Zoom, Slack, 7-Zip, WinRAR, VLC, Notepad++.
• Developer or runtime tools: Java, Python, Node.js, .NET runtimes, Git, Visual Studio Code.

A worked timeline: Microsoft Patch Tuesday

Microsoft releases its main monthly cumulative security updates on the second Tuesday of each month (“Patch Tuesday”, around 6:00pm UK time). For example, if Patch Tuesday falls on Tuesday 10 November 2026, the 14-day window closes on Tuesday 24 November 2026. Remember that a Windows cumulative update is not fully applied until the laptop restarts — so if your update policy downloads the patch on day 2 but lets the user snooze the reboot for three weeks, that laptop fails a Cyber Essentials Plus audit on day 15.

What if an update breaks a critical business app?

If a vendor update genuinely breaks a mission-critical system and cannot be applied within 14 days, v3.3 allows vendor-approved workarounds (such as a registry fix, script or configuration change prescribed by the vendor to mitigate the vulnerability) or temporarily isolating the affected system from internet traffic in a segregated sub-set until fixed.