The 14-day rule: keeping security updates under control

Of all the Cyber Essentials requirements, the 14-day rule is the one that catches the most small businesses out, because it depends on what happens every week rather than on a setting you change once. This article explains what the rule says, what it covers and how to keep it under control.

Why updates matter

The NCSC’s requirements explain the thinking. Any device that runs software can contain security flaws, known as vulnerabilities, and they are regularly found in all sorts of software. Once a flaw is public, malicious individuals or groups move quickly to exploit it. Vendors respond with fixes, which the document says can be patches, security updates, registry fixes, scripts, configuration changes or any other mechanism the vendor prescribes.

The aim of the control is to make sure devices and software are not vulnerable to known security issues for which fixes are available.

What the rule says

All software on in-scope devices must be licensed and supported, removed when it becomes unsupported, and set to update automatically where possible. On top of that, an update must be installed within 14 days of release when it meets any of these conditions:

• it fixes vulnerabilities the vendor describes as critical or high risk
• it addresses vulnerabilities with a CVSS v3 base score of 7 or above
• the vendor gives no details of how serious the fixed vulnerabilities are

The Common Vulnerability Scoring System, or CVSS, is a standard way of rating severity. The requirements say that if a vendor uses different terms, critical or high risk means a CVSS v3 base score of 7 or above, or whatever the vendor identifies as critical or high risk.

The document gives its reasoning for the figure: 14 days is considered a reasonable period to implement the requirement, because any longer is a serious security risk while a shorter period may not be practical.

Two details help in practice:

• Bundled updates. Some vendors release one update that fixes several issues of different severity. If it covers any critical or high risk issue, the whole update must be installed within 14 days.
• Other updates. The document strongly recommends, but does not make mandatory, applying all released updates within 14 days.

What counts as software

The definition is broad. It includes operating systems, commercial off-the-shelf applications, extensions, interpreters, scripts, libraries, network software and the firmware of firewalls and routers. So the rule reaches beyond Windows and macOS. Browsers, plug-ins, office applications and the router in your office all need to be on your list.

The control applies to servers, desktop computers, laptops, tablets, mobile phones, firewalls, routers and cloud services. For cloud services, the document explains who is typically responsible. For software as a service, the cloud provider handles security update management, while for infrastructure as a service your organisation and the provider share it.

How it is checked

In the self-assessment, you answer questions about how you keep software up to date. In Cyber Essentials Plus, the checking is technical. The Plus test specification describes an authenticated vulnerability scan of sampled devices. The assessor looks for vulnerabilities that meet any of the three criteria above. If any exist and the vendor’s fix has been available for more than 14 days, that sub-test is a fail.

The same document says any single fail means a fail for the whole assessment. So a missed update on one device can matter.

Cloud services and the 14-day rule

The rule does not stop at devices you can touch. The requirements include cloud services in the security update management control, and the table in the document shows who is typically responsible. For software as a service, such as Microsoft 365 or Dropbox, the cloud provider handles it. For infrastructure as a service, where your organisation configures virtual servers, you and the provider share the work, so any server you run in the cloud needs the same 14-day discipline as one under your desk. Where the provider carries a control on your behalf, make sure it has committed to it in a contract or a document the contract refers to.

A practical routine

1. Turn on automatic updates for operating systems, browsers and applications wherever you can. The requirements ask for this where possible.
2. Keep a simple list of devices and software, so that you know what exists. A forgotten tablet in a drawer is still a device if it connects to your data.
3. Pick a weekly check. A fixed slot, say Monday morning, to confirm that updates have landed, turns a 14-day window into two reliable chances.
4. Do not forget network equipment. Routers and firewalls have firmware that needs updating too.
5. Chase the stragglers. Laptops that are switched off or taken home are the usual culprits.
6. Remove what the vendor no longer supports. See our article on unsupported software.

The NCSC’s vulnerability management guidance gives wider advice to organisations building a vulnerability process, which can be useful as you grow.

The 14 days start at release

The clock starts when the vendor releases the update, not when you notice it. That is why automatic updates are so valuable: they remove the gap between release and installation. Where updates cannot be automatic, a regular review is your safety net.

In short

Critical and high risk updates, those with a CVSS v3 score of 7 or above or with no severity details from the vendor, must be installed within 14 days of release. Software must be licensed, supported and, where possible, set to update automatically. The rule covers more than computers: phones, routers and firewalls count as well.

How Vigil CE helps

Vigil CE keeps a running view of your devices and software and reminds you when update checks are due, so the 14-day window becomes a routine rather than a scramble. You can see which devices are up to date and which need attention, all in one list.