Cyber Essentials Control 3: Security Update Management — The New Auto-Fail Rules

Fourteen days. No exceptions. No excuses.

Security update management has always been part of Cyber Essentials. What has changed under Danzell is the consequence of getting it wrong. Two new questions — A6.4 and A6.5 — are designated as automatic-failure questions. If you cannot demonstrate that all high-risk and critical security updates are applied within 14 days of release, you fail the assessment automatically. No compensating controls. No partial credit. No second chance within that assessment cycle.

This is arguably the most impactful change in the Danzell update, because it transforms patching from a best-practice recommendation into a hard, binary requirement. For organisations with disciplined patch management, this changes nothing. For organisations that rely on 'we update when we get around to it' — and there are far more of these than the industry admits — this is a wake-up call.

A6.4 and A6.5 explained.

The 14-day window begins from the date the vendor releases the update — not from the date your organisation becomes aware of it. This means you need a proactive process for identifying when updates are released, not a reactive process that waits for something to break. For most SMEs, enabling automatic updates is the simplest and most reliable way to meet this requirement.

Unsupported software is an automatic fail.

Software that is no longer supported by its vendor — meaning the vendor no longer releases security updates for it — cannot meet the patching requirement by definition. If you cannot patch it, you cannot be compliant. Under Danzell, unsupported software must be removed from scope entirely.

The revised sampling process catches selective patching.

IASME's audits have identified a practice where organisations apply updates only to the specific devices selected in the CE Plus random sample — rather than across their entire estate. The Danzell update addresses this directly with a revised sampling process.

Under the new CE Plus rules, if the initial random device sample fails due to missing updates, remediation is required. But the retest now covers both the original sample and a new random sample of different devices. This means you cannot fix just the devices the assessor checked — the second sample tests whether updates have been applied across the whole estate. A second failure results in revocation of the verified self-assessment certificate — meaning you lose your CE as well as failing CE Plus.

How to meet the 14-day requirement.

Patching is not a once-a-year exercise.

The 14-day patching requirement applies continuously — not just at assessment time. Under Danzell, the director declaration includes a commitment to maintain Cyber Essentials controls throughout the certification period. An organisation that patches everything before the assessment and then stops patching for the remaining eleven months is not compliant — and if a breach occurs during that period, the certification provides no protection.

For continuous patching visibility, SOC in a Box monitors your environment 24/7 and flags devices that are falling behind on updates — providing the ongoing assurance that point-in-time assessments cannot. Combined with our vulnerability scanning service, this creates a continuous compliance posture that satisfies both the letter and the spirit of the requirement.

Part 6 preview.

Next week, we cover Control 4 — User Access Control. This is the second control with automatic-failure implications under Danzell, driven by the mandatory MFA requirement for all cloud services. We cover what counts as a cloud service, what counts as MFA, and how to audit your estate to ensure every service is compliant before you open your assessment account.

Related Articles