Security updates fix weaknesses that criminals could exploit to access your systems or disrupt your business. Having a reliable way to install those updates helps protect the equipment and applications your team uses every day.

Security update management is one of the five Cyber Essentials controls. It covers more than Windows updates: applications, router and firewall firmware, and other software within your assessment scope need attention too.

What does Cyber Essentials require?

Software in scope must be licensed, supported and kept up to date. Enable automatic updates where possible.

Cyber Essentials requires vulnerability fixes to be applied within 14 days of release where:

• The vendor describes the vulnerability as critical or high risk.
• The vulnerability has a Common Vulnerability Scoring System (CVSS) v3 base score of 7 or above.
• The vendor provides no information about the severity of the vulnerabilities addressed.

The deadline starts when the fix is released, rather than when your business discovers it. Apply fixes as soon as practical instead of treating 14 days as a waiting period.

Software that no longer receives security fixes also needs action. Ask your IT team or provider about upgrading, replacing or removing it.

How can central management tools help?

Central management tools can make it easier to apply consistent update settings and identify devices that need attention.

For example, Microsoft Intune can help administrators manage Windows update policies and review the reported operating system versions and update status of enrolled devices.

Policies can control when updates are offered and when restarts become necessary. Give staff clear notice of restart requirements, while ensuring any grace periods fit within the applicable security deadline.

However, managing Windows updates does not automatically cover every application. Ask your provider how browsers, business applications and other installed software receive their updates.

What if a device falls behind?

A device may miss updates because it is switched off, rarely connects to the internet or encounters an installation problem.

Reporting and compliance checks can help identify devices that fall behind your organisation’s requirements. Someone then needs to investigate and confirm that the problem has been resolved.

Agree who will:

• Review update reports and investigate failures.
• Contact users whose devices are not checking in.
• Arrange any manual work or restarts.
• Confirm that fixes have installed successfully.

Include remote workers and less frequently used equipment in these checks.

What about routers, firewalls and other network equipment?

Network equipment also runs software, often called firmware, which may need security updates.

Updating a router or firewall can interrupt connectivity, depending on your network’s design and resilience. Plan the work with the people responsible for the equipment and consider which business services could be affected.

We recommend agreeing suitable maintenance windows, notifying affected users and having a recovery plan if an update causes problems.

Out-of-hours maintenance may be appropriate, but your process also needs to accommodate urgent fixes. A routine monthly maintenance window may not meet a 14-day deadline.

How do you know your update process is working?

Scheduling an update does not confirm that it installed.

Ask your IT team or provider what reporting is available, how missed updates are followed up and who checks equipment outside the central management system.

Keep an accurate record of the devices and software your business uses, who maintains them and when vendor support ends. This helps you identify gaps before they become an assessment issue.

Make responsibilities clear

Your business may use different providers for computers, applications and network equipment. Confirm who monitors security releases, installs fixes and checks the results for each area.

Speak to Beaming about the network and device security requirements raised by your Cyber Essentials preparation.