Apple devices and updates

Apple does not give severity ratings for its security fixes. Under the Cyber Essentials rules, an update with no severity details must be installed within 14 days of release, so treat every Apple security release as high or critical. Once a newer macOS, iOS, iPadOS or Safari version is released, the older one is out of date 14 days after that release date. A device one version behind is fine, as long as the update is installed, and your assessment submitted, within 14 days of the newer release.

Two checks for every Apple device

1. Is the version line still supported? The device must run a macOS, iOS or iPadOS version that Apple still patches.
2. Is the latest security release for that line installed? It must be installed within 14 days of Apple releasing it.

Apple publishes every security release, with its date, on its security releases page. Use those dates for the 14-day clock.

Which versions count as supported

Apple does not publish end-of-support dates. Its usual pattern is to keep patching the current major version and some older ones, but fixes for older versions are not guaranteed to be complete. IASME's Knowledge Hub lists the versions it currently treats as supported for Cyber Essentials. At the time of review (November 2026), that was:

• macOS: 27 (Golden Gate), 26 (Tahoe) and 15 (Sequoia)
• iOS and iPadOS: 27, 26, 18 and 16, plus iPadOS 17. iOS 17 is not treated as supported.

These lists change when Apple ships a new major version or stops patching an old one. Check the IASME pages for macOS and iOS before you submit.

Worked example

On 9 November 2026 Apple released macOS Tahoe 26.7.3, macOS Sequoia 15.8.3 and iOS 27.2.1.

• A Mac on macOS 26.7.2 is one version behind. It is fine until 23 November 2026. After that it does not meet the rule.
• A Mac on macOS 15.8.2 must reach 15.8.3 by the same date. Staying on Sequoia is fine while that line is supported, but its point releases still have to be installed.
• An iPhone on iOS 27.2 must be on 27.2.1 by 23 November 2026.

If you submit your assessment on 20 November with those devices on the older versions, the answer is still compliant on the day, but only if the updates go on before 23 November. See the 14-day update rule.

Safari

Safari is a separate application for this rule. On older supported macOS versions, Apple ships Safari updates on their own. For example, Safari 27.2 was released on 26 October 2026 for macOS Sequoia and Tahoe. On the newest macOS, Safari updates arrive with the operating system. Either way, list the Safari version in the browser question and install new releases within 14 days.

Background Security Improvements

Apple now also ships smaller security fixes, called Background Security Improvements, which appear on the security releases page. Treat them the same way: make sure devices are set to install them automatically.

Older hardware

A Mac, iPhone or iPad that cannot install a supported version is unsupported, however well it works. For example, a Mac whose last available version is macOS Sonoma 14 is outside the list above. You need to replace it, remove it from scope, or isolate it in a sub-set with no internet access. See options for unsupported software.

Watch for devices that can install a supported major version but have stopped receiving its point releases. Check the release notes on Apple's page for which devices each update covers.

Settings to check

• Mac: System Settings, General, Software Update, Automatic Updates. Turn on downloading and installing macOS updates and app updates, and any option for security responses or system files.
• iPhone and iPad: Settings, General, Software Update, Automatic Updates. Turn on both download and install, and any option for security responses or background security improvements.

Menu names change between versions, so look for the equivalent setting if yours differs.

• Managed devices: use your MDM to set update deadlines shorter than 14 days and to force a restart.

In your answers

List Apple devices with their operating system version in the scope section, for example "8 MacBook Air, macOS 26 Tahoe" and "12 iPhone, iOS 27". Name Safari and its version in the browser question.

The readiness checker covers these points before you start.