Security update management

Security update management makes sure your devices and software are not open to known flaws that already have a fix. Under Requirements v3.3, all software in scope must be licensed and supported by its vendor, unsupported software must be removed or isolated, automatic updates must be on where possible, and critical or high-risk updates must be installed within 14 days of release.

What counts as software

Version 3.3 defines software broadly: operating systems, off-the-shelf applications, browser extensions, interpreters, scripts, libraries, network software, and firewall and router firmware. The control applies to servers, desktops, laptops, tablets, phones, firewalls, routers and cloud services.

The requirements, in plain English

All software on in-scope devices must:

1. Be licensed and supported. You must have the legal right to use it, and a vendor must be committed to providing regular security fixes and must publish the date that support ends. The vendor does not have to be the original author, but it must be able to change the software to fix it.
2. Be removed when it becomes unsupported, or taken out of scope in a sub-set that blocks all traffic to and from the internet. See unsupported software options.
3. Have automatic updates turned on where the software allows it.
4. Be updated within 14 days of release when the update meets the conditions below.

The 14-day limit applies to any update that fixes vulnerabilities:

• the vendor describes as critical or high risk, or
• with a CVSS v3 base score of 7 or above, or
• where the vendor gives no details of their severity at all.

CVSS, the Common Vulnerability Scoring System, is the industry scale for rating how serious a flaw is. If a vendor releases one combined update that fixes several issues, and any of them is critical or high, the whole update falls under the 14-day rule. The NCSC strongly recommends installing every update within 14 days, but only the critical and high ones are mandatory.

"Vulnerability fixes" is wider than patches. It includes updates, registry fixes, configuration changes and scripts, whatever the vendor approves to fix a known flaw.

How strictly this is applied

Under the Danzell question set, the questions on installing critical and high updates within 14 days (A6.4 for operating systems and router or firewall firmware, A6.5 for applications) are treated as automatic fails. Any non-compliant answer on a requirement also fails the assessment. See the 14-day update rule.

Apple devices

Apple publishes security notes for each release but does not give severity ratings in a form that maps to the scheme, so we treat every Apple security release as critical or high. Once a newer macOS, iOS, iPadOS or Safari version is released, the older version stops being compliant 14 days after that release date. A device one version behind is fine, provided the update is installed, and your assessment submitted, within those 14 days. See Apple devices and updates.

Common problems

• Windows 10 devices still in use without Extended Security Updates. See Windows 10 end of support.
• Phones or tablets too old to receive the current operating system. See mobile devices and support.
• Old versions of Java, Adobe Reader or browser plug-ins left installed.
• Router or firewall firmware nobody has checked since installation.
• Laptops that sit switched off or off-network and miss updates.

What to do

1. Build a list of operating systems, applications and firmware in scope, with version numbers.
2. Check each is still supported. See the supported software rule.
3. Turn on automatic updates for operating systems, browsers and applications, and enforce them centrally where you can.
4. Keep a short list of anything that needs manual patching, and check it at least every two weeks so nothing passes the 14-day limit.
5. Remove software you do not need. Fewer applications means fewer updates to track.
6. Before you submit, check every device is on a current version.

The readiness checker includes the update questions and flags common end-of-life software.