Answering the security update questions (A6)

The security update questions check two things: that all software in scope is licensed and still supported by its vendor, and that critical and high-risk fixes are installed within 14 days of release. A good answer lists your operating systems and key applications with versions, shows automatic updates are on, and describes how anything that cannot auto-update is patched in time. Under Danzell, the two 14-day questions (A6.4 and A6.5) are automatic fails if the answer is No.

Your Certification Body marks the real submission. This is Apexward's guidance from public sources.

What the questions are checking

Supported operating systems and software (A6.1 to A6.2.4)

Every operating system must be supported by a vendor that produces regular security fixes. Router and firewall firmware counts as an operating system here. All other software must be supported too, including frameworks and browser extensions. If an operating system is past its end date but has a paid extended update scheme, such as Windows 10 Extended Security Updates, you must hold the subscription.

You are then asked to list, with versions:

• internet browsers (A6.2.1)
• malware protection (A6.2.2)
• email applications on devices and servers (A6.2.3)
• office applications that create organisational data (A6.2.4)

Give the version on the day you submit, and say it updates automatically. For example: "Google Chrome and Microsoft Edge, current stable releases, auto-update enforced by Intune; Safari, kept current through macOS updates."

Unlicensed or unsupported software (A6.3)

This asks whether any in-scope software or cloud service is unlicensed or unsupported. The compliant answer is No. Free and open-source software is fine if you follow its licence. Some products, such as firewalls with security subscriptions, stop receiving updates if the annual licence lapses.

The 14-day rule (A6.4 and A6.5)

A6.4 covers operating systems and router and firewall firmware. A6.5 covers applications, including their associated files and extensions. Updates must be installed within 14 days of release when:

• the vendor rates the fix critical or high risk
• the fixed vulnerability has a CVSS v3 base score of 7 or more
• the vendor gives no severity at all

A bundled update that contains any critical or high fix counts. Feature updates and optional updates are not required. The answer must be true at all times, not just on the day you submit.

Automatic and manual updates (A6.4.1, A6.4.2, A6.5.1, A6.5.2)

Turn automatic updates on wherever possible. Where you patch by hand, for example servers, firewalls or line-of-business software, describe the routine and who runs it. If you only use automatic updates, say so.

A good answer: "Windows Update for Business rings in Intune, quality updates deferred 0 days for most devices and 3 days for a pilot group, deadline 7 days, forced restart after the deadline. Firewall firmware is checked weekly by our IT provider and installed within 7 days of release."

Removing or isolating unsupported software (A6.6 and A6.7)

Unsupported software must be removed. If you have a business need to keep it, it must be moved into a sub-set, separated by a firewall or VLAN, that blocks all traffic to and from the internet. If that sub-set can still reach the internet, you cannot certify the whole organisation. If you use no unsupported software, say so in A6.7.

Apple devices

Apple does not give severity ratings for its fixes, and an update with no severity details falls under the 14-day rule, so treat every Apple security release as high or critical. Once a newer macOS, iOS, iPadOS or Safari version is released, the older one is out of date 14 days later. See Apple devices and updates.

What assessors typically query

• Browser or office versions missing.
• Windows 11 versions past their end date, as each feature version has its own.
• Phones or tablets on old operating systems.
• "We patch monthly", which can leave a fix uninstalled for more than 14 days.
• Firewall firmware not mentioned.

Answers that fail

• No to A6.4 or A6.5.
• Any unsupported operating system or application in scope.
• Windows 10 in scope without Extended Security Updates.

Checklist

1. List every operating system, firmware and key application with its version.
2. Check each against the vendor's support dates.
3. Turn on automatic updates, including restarts.
4. Write down the manual routine for the rest.

Read more in the 14-day update rule, the supported software rule and options for unsupported software.