Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

Cyber Essentials 14-day patch rule explained

Written by Ruben Selby, founder and penetration tester at Wolfcore. Last reviewed 14 November 2026.

In one sentence: Under Cyber Essentials, any software update that fixes a serious security flaw must be installed within 14 days of its release, on every device and cloud service in your scope.

What it is

This is the “Security Update Management” control in the NCSC document Cyber Essentials: Requirements for IT Infrastructure v3.3, dated April 2026. Its stated aim is to make sure devices and software are “not vulnerable to known security issues for which fixes are available”.

A patch is a fix from the vendor (see patch management). Attackers read the same announcements you do. Once a flaw is public, the clock runs in their favour.

How it works

The NCSC text says all software on in-scope devices must be licensed and supported, removed when it becomes unsupported, set to update automatically where possible, and updated within 14 days of release where any one of these is true:

  1. The vendor describes the vulnerability as “critical” or “high risk”.
  2. The update addresses a vulnerability with a CVSS v3 base score of 7 or above.
  3. The vendor gives no details of how serious the fixed flaws are.

Three details catch people out:

  • The NCSC says that if one update covers several issues and any is critical or high risk, it “must be installed within 14 days”.
  • “Vulnerability fixes” include patches, updates, registry fixes, configuration changes and scripts, so a vendor workaround counts.
  • “Software” includes operating systems, applications, extensions, scripts, libraries and firewall and router firmware.

The NCSC adds that it “strongly” recommends applying every update within 14 days but says this is not mandatory, and that 14 days is “considered a reasonable period”.

The UK angle

At Cyber Essentials Plus the rule is tested, not just declared. IASME says an assessor runs “a full vulnerability scan or manual check against each device” to confirm software is supported and “all high and critical vulnerability patches” were applied within 14 days. The NCSC also says to patch remote access and internet-facing devices “immediately” in its ransomware guidance. So 14 days is the ceiling for Cyber Essentials, not the target for a VPN or firewall.

Who it affects and how badly

  • Sole trader to 10 staff: The risk is forgotten devices. A laptop left off for a month misses the window. Worst case: a failed certification and a rework delay.
  • 10 to 50 staff: Accountancy, legal and recruitment firms with a mix of laptops and third-party apps. Browsers and PDF tools often sit outside normal updates.
  • 50 to 250 plus: Manufacturers, councils and care providers with servers, firewalls and old line-of-business software. Unsupported software is the usual blocker.

Worked example (illustration only)

A 20-person estate agency has Windows laptops on automatic updates. Its office firewall runs firmware from three years ago, and nobody owns it. The vendor releases a fix for a flaw rated 9.8 on CVSS. Nobody sees the notice. At the Cyber Essentials Plus audit the firewall fails the check. The cost is a failed test case, an urgent firmware upgrade, and a re-test. The fix is to name an owner for the firewall and put it on the patch list.

Day 0Vendor releases fixDay 14Must be installedTest and roll out inside this windowOverdue
Timeline: update released on day 0, fourteen days to install if critical or high, then it is overdue

How to detect a missed patch

  1. List every device, server, firewall, router and cloud service in scope.
  2. Check Windows Update history per device.
  3. Check browser and PDF reader versions on a sample of machines.
  4. Look up firewall and router firmware versions against the vendor’s security notices.
  5. Confirm nothing in scope is out of vendor support.

How to fix or prevent it

  1. Turn on automatic updates for operating systems, browsers and apps wherever the setting exists.
  2. Name an owner for each firewall, router and server, and diarise a vendor notice check.
  3. Replace or isolate unsupported software. The NCSC allows a defined sub-set that blocks all internet traffic.
  4. Fit any testing of patches inside the 14 days, because the requirement has no extra time for it.
  5. Plan for holidays, when devices are off.
  6. Keep a simple record of when each update was released and installed.

Related terms

Cyber Essentials, Cyber Essentials Plus, Patch management, CVSS, CISA KEV catalogue, Cyber Essentials Plus vs penetration test

Back to the Compliance, frameworks and governance hub.

If you are asking whether Plus also needs a penetration test, read Cyber Essentials Plus vs penetration test.

Frequently asked questions

Do all updates need installing within 14 days? No. The NCSC says it is recommended but not mandatory. The rule is mandatory for critical or high risk fixes, CVSS 7 or above, or updates with no severity given.

Does the rule apply to firewalls and routers? Yes. The NCSC definition of software includes firewall and router firmware.

What if I cannot patch something? Remove it from the device, or move it to a sub-set that blocks all internet traffic.

How Wolfcore helps

Wolfcore’s secure-by-design consulting gets you ready for Cyber Essentials Plus, ISO 27001, SOC 2 or NIS2 without the paperwork taking over. See https://wolfcore.co.uk/services/secure-by-design-compliance/