Skip to main content

Cyber Essentials: Software Updates

The Cyber Essentials Software Updates control requires that all software (operating systems, browsers, apps, and firmware) is kept up to date. Known vulnerabilities in unpatched software are one of the most common routes attackers use to gain access to systems. Cyber Essentials requires that critical patches are applied within 14 days of release. These guides cover every Software Updates requirement.

Last reviewed: July 2026

Software Updates

Cyber Nova AI helps you prepare for Cyber Essentials. It doesn't award or certify it. Follow the steps here to get ready, then apply for certification through an accredited Cyber Essentials body when you're set.

What this control covers

  • Enable automatic operating system updates on Windows, Mac, iOS, and Android
  • Keep your web browser up to date: one of the most frequently exploited apps
  • Enable automatic firmware updates on your router
  • Maintain a monthly routine to update all apps that don't auto-update
  • Establish a formal patch management process for business devices (14-day CE requirement)

Software Updates Guides (6)

Test yourself

A few quick questions to check what you have learned. Pick an answer to see whether it is right and why. Nothing is saved or scored.

1. What is the best setting for security updates?
2. Is it safer to install a security update now or wait a few weeks?
3. Your device no longer receives security updates. What should you consider?

Track your Software Updates progress. Free.

Create a free account to tick off tasks as you complete them and see your overall Cyber Essentials readiness score.

Start your free security check

Common questions

How quickly do I need to install security updates under Cyber Essentials?

Cyber Essentials requires that high or critical security patches are applied within 14 days of release. For other updates, they should be applied within a reasonable timeframe. Turning on automatic updates is the simplest way to meet this requirement for most consumer devices. Under the 2026 requirements this is now an automatic-fail area for businesses: high-risk or critical updates must be installed within 14 days, or the assessment fails.

What happens if I use software that no longer receives updates?

Under Cyber Essentials, software that is no longer supported and no longer receives security updates must be removed from in-scope devices, or isolated so it cannot connect to the internet or other devices. Running unsupported software is one of the most common reasons Cyber Essentials assessments fail.

Do I need to update my router firmware?

Yes. Router firmware updates fix security vulnerabilities in the device that controls your entire network connection. Many routers can be set to update automatically; if yours cannot, check manually every few months. Your router's settings page will usually show the current firmware version and any available updates.

Are security updates safe to install straight away?

Security patches specifically are almost always safe to install promptly. The risk of being exploited through an unpatched vulnerability is much greater than the small risk of a problematic update. If you are concerned, check for any widely reported issues before installing major feature updates, but apply security-only patches as soon as possible.

Other Cyber Essentials Controls