Cyber Essentials: Software Updates
The Cyber Essentials Software Updates control requires that all software (operating systems, browsers, apps, and firmware) is kept up to date. Known vulnerabilities in unpatched software are one of the most common routes attackers use to gain access to systems. Cyber Essentials requires that critical patches are applied within 14 days of release. These guides cover every Software Updates requirement.
Last reviewed: July 2026
Cyber Nova AI helps you prepare for Cyber Essentials. It doesn't award or certify it. Follow the steps here to get ready, then apply for certification through an accredited Cyber Essentials body when you're set.
What this control covers
- ✓Enable automatic operating system updates on Windows, Mac, iOS, and Android
- ✓Keep your web browser up to date: one of the most frequently exploited apps
- ✓Enable automatic firmware updates on your router
- ✓Maintain a monthly routine to update all apps that don't auto-update
- ✓Establish a formal patch management process for business devices (14-day CE requirement)
Software Updates Guides (6)
- Enable automatic operating system updatesTurn on automatic updates for Windows, macOS, iOS, or Android so security patches are applied as soon as they are released.
- Keep your web browser up to dateCheck that your browser (Chrome, Firefox, Safari, Edge) is on the latest version and set to update automatically.
- Keep your phone's operating system up to dateEnable automatic updates on your iPhone or Android phone so that security patches are installed as soon as they are released. Outdated phone software is one of the most common ways attackers gain access to devices.
- Enable automatic firmware updates on your routerCheck whether your router can update its firmware automatically and turn this feature on if available.
- Set a monthly reminder to update all appsManually check for and install updates for all installed apps on your computer and phone once a month.
- Establish a patch management process for your businessCreate a documented process to ensure all business devices and software are patched within 14 days of a critical update being released.
Test yourself
A few quick questions to check what you have learned. Pick an answer to see whether it is right and why. Nothing is saved or scored.
Track your Software Updates progress. Free.
Create a free account to tick off tasks as you complete them and see your overall Cyber Essentials readiness score.
Start your free security checkCommon questions
How quickly do I need to install security updates under Cyber Essentials?
Cyber Essentials requires that high or critical security patches are applied within 14 days of release. For other updates, they should be applied within a reasonable timeframe. Turning on automatic updates is the simplest way to meet this requirement for most consumer devices. Under the 2026 requirements this is now an automatic-fail area for businesses: high-risk or critical updates must be installed within 14 days, or the assessment fails.
What happens if I use software that no longer receives updates?
Under Cyber Essentials, software that is no longer supported and no longer receives security updates must be removed from in-scope devices, or isolated so it cannot connect to the internet or other devices. Running unsupported software is one of the most common reasons Cyber Essentials assessments fail.
Do I need to update my router firmware?
Yes. Router firmware updates fix security vulnerabilities in the device that controls your entire network connection. Many routers can be set to update automatically; if yours cannot, check manually every few months. Your router's settings page will usually show the current firmware version and any available updates.
Are security updates safe to install straight away?
Security patches specifically are almost always safe to install promptly. The risk of being exploited through an unpatched vulnerability is much greater than the small risk of a problematic update. If you are concerned, check for any widely reported issues before installing major feature updates, but apply security-only patches as soon as possible.