Step 4 of 7
Security updates
Most attacks use flaws that already have a fix available. Cyber Essentials expects everything you use to be supported by its maker and kept up to date.
How to do it
Check everything is still supported
Software that no longer gets security updates isn't allowed. Windows 10 reached end of support in October 2025, so it only counts if it's covered by Microsoft's Extended Security Updates. Check older versions of Office, old phones and tablets, and anything else past its end-of-life date. Upgrade, replace or remove it.
Switch on automatic updates
Turn on automatic updates for Windows, macOS, iPhone, Android, web browsers and your apps wherever the option exists.
Install critical updates within 14 days
Updates the maker rates as critical or high risk must be installed within 14 days of release. Make sure devices actually restart to finish updating, and check once a week that nothing has fallen behind.
Don't forget the router
Routers and firewalls need firmware updates too. If yours no longer gets them, it needs replacing.
Common reasons people get caught out
- An old laptop in a drawer that still gets used now and again
- Phones too old to receive the latest updates
- Unsupported apps such as old versions of PDF readers
Your checklist for this step
- All software licensed and still supported
- Automatic updates switched on
- Critical and high-risk updates installed within 14 days
- Router and firewall firmware up to date
This guide summarises Cyber Essentials Requirements v3.3 for small businesses. It is general guidance, not the official question set. Check the current requirements on the IASME website before you submit. Last updated 2 November 2026.