What Is Patch Management and Why Do Cyber Essentials Assessors Keep Asking About It?

At a Glance

Patch management is a structured process for keeping operating systems, applications and other IT assets updated against known security vulnerabilities. Under Cyber Essentials, security update management is one of five core technical controls, with certain vulnerability fixes required within 14 days. Maintaining an accurate asset inventory, enabling automatic updates and removing unsupported software can help businesses stay secure and certification-ready.

Is your organisation’s patch management process in line with Cyber Essentials requirements? Book a free IT review with Redpalm to find out.

Patching Software

You have enabled multi-factor authentication (MFA), updated your passwords and configured your firewall settings. However, when considering security controls for Cyber Essentials, another control to consider is checking whether your systems and software are up to date.

This matters because once a software vulnerability is known, attackers may try to exploit organisations that haven’t fixed it yet. Keeping software updated closes known security gaps, and this process is called patch management.

But why is patch management important? Because it’s part of maintaining your organisation’s cyber security and relevant to Cyber Essentials’ five technical controls.

In this guide, explore which systems and software need software patching procedures, how quickly security updates need to be applied and why this matters for Cyber Essentials.

What is Patch Management?

Patch management is a structured process an organisation uses to identify, acquire, test and deploy software patches to its IT assets.

A patch is a specific change or set of updates that software developers provide to fix software bugs, improve performance, add new features and, importantly, fix vulnerabilities attackers could exploit. Patches can range from small fixes for specific issues to a larger collection of updates containing multiple fixes.

A patch management programme creates a consistent, repeatable process for applying these patches. It also forms a key part of your vulnerability remediation process to keep your IT environment secure.

But effective patch management is more than just clicking on “update now”. You also need to know:

• which devices and software your organisation is using
• whether they are still supported
• which updates are available
• whether those updates have been installed

For Cyber Essentials, it’s important to understand that a vulnerability fix is not always a regular patch download. Vendors may fix vulnerabilities through an update, script or configuration change or registry fix.

Why Unpatched Software Is Such a Common Way In for Attackers

Once a security vulnerability is identified and a fix is released, leaving the affected software unpatched means leaving a known weakness for an attacker to exploit.

Attackers can exploit known vulnerabilities in unpatched systems, applications and devices to gain access or establish a foothold in an organisation. The NCSC therefore recommends applying updates as soon as possible and enabling automated updates where possible.

Patch Management as One of the Five Core Cyber Essentials Controls

Cyber Essentials is built around five core technical controls:

• Firewalls
• Secure configuration
• Security update management
• User access control
• Malware protection

Patch management is formally called security update management under Cyber Essentials. It aims to prevent devices and software from remaining vulnerable to known security issues with available fixes.

Under the current Cyber Essentials requirements, you need to license and appropriately support all software within your assessment scope. You also need to enable automatic updates where possible.

It’s critical to install security updates and vulnerability fixes within 14 days of their release when:

• The vendor classifies the vulnerability as critical or high risk,
• The vulnerability has a CVSS v3 base score of 7 or above, or
• The vendor does not provide details of the severity of the vulnerability addressed by the update.

In addition to patch management, you must also address unsupported software in your environment. If a vendor no longer supports a product’s vulnerability fixes, continuing to use it may not meet the Cyber Essentials security update management requirements. 

Cyber Essentials assessors often enquire whether Windows is updated, as well as about applications, mobile devices, servers, routers, firewalls, and cloud services included in your assessment. Unsupported software must be removed from in-scope devices or removed from scope using a defined subset that prevents traffic to and from the internet.

Patch Management Best Practices for Small and Medium Businesses

Now that you know what patch management is and why it is important, explore some of the patch management best practices for SMEs.

• Create an inventory of your devices and software to know what needs maintaining
• Remove applications that are outdated and no longer required, and plan replacements
• Enable automatic updates where possible
• Use centralised device management or patching tools where appropriate to manage updates and patches on multiple devices
• Assign clear responsibilities for checking and deploying updates
• Also keep firewalls, routers and other networking devices updated
• Understand which security update controls your cloud and software providers implement and which you are responsible for

What Happens If Patching Falls Behind

Missing a few updates may seem like something you’ll catch up on. But the longer you keep known vulnerabilities unresolved, the more time attackers have to exploit them. Moreover, falling behind schedule can create practical problems when you apply for or renew Cyber Essentials certification.

The solution isn’t to install everything the day before the assessment but to establish a repeatable process that keeps your environment updated year-round.

• If you’re already falling behind schedule, first establish what has been affected
• Next, identify unsupported software and high-risk vulnerabilities first
• Then create a structured remediation plan to address each vulnerability according to its priority

Contact Redpalm to Get Your Patch Management Ready for Cyber Essentials

Patch management seems simple until you have dozens or hundreds of devices, applications, cloud services and network components to manage.

When you partner with Redpalm for Cyber Essentials Readiness, we can help you understand how your current update process compares with Cyber Essentials and Cyber Essentials Plus requirements. We can help you identify gaps and address problems before they delay your certification. We’re a Cyber Essentials Certification Body, and we understand what assessors are looking for.

Patching continues even after you receive your certification with our wider cyber security and vulnerability management services. We can help you identify weaknesses, address them, and strengthen security controls year-round.

Get in touch to get your systems ready for Cyber Essentials.