How to build a 14-day security update process

Cyber Essentials requires critical and high-risk security updates within 14 days of release.

Sounds straightforward… until you realise updates don’t arrive neatly once a month, and some of the most important ones don’t even look urgent at first glance.

What we often see

• Updates delayed because “we’ll do them all at once”
• Devices missing patches because they’re rarely switched on
• Third-party apps (Adobe, Java, browsers) quietly out of date
• No clear view of what software is actually installed
• Emergency fixes missed because no one is watching for them

Here’s how to build a process that actually works.

Understand what counts as critical

The 14-day requirement applies to specific types of updates:

CVSS v3 base score of 7 or above: This is the technical standard. Anything scoring 7.0 to 10.0 needs attention within 14 days.

Vendor-labeled “critical” or “high risk”: Even if no CVSS score is provided, vendor severity ratings trigger the requirement.

Unknown severity updates: If the vendor doesn’t specify severity levels, treat the update as critical and apply the 14-day rule.

Mixed severity bundles: When vendors package multiple fixes together, the highest severity level determines the timeline. One critical fix in a bundle makes the entire update subject to 14-day requirements.

This means you can’t wait for monthly patch cycles if critical updates are released weekly.

In practice, a lot of recent attacks haven’t relied on brand-new vulnerabilities. They’ve used known issues that simply weren’t patched in time.

Set up automatic updates where possible

Automatic updates handle routine patching without manual intervention. But they need careful configuration to work properly.

Operating systems: Enable automatic updates for security patches. Configure them to install during off-hours to avoid disrupting work.

Browsers: Set browsers to update automatically. This catches many common attack vectors without user involvement.  Remember to close the browser to allow the update to run though.  This matters more than ever, as a growing number of attacks now happen through browsers and web sessions rather than traditional downloads.

Security software: Antivirus and anti-malware tools should update automatically. Most can update several times per day.

Office applications: Enable automatic updates for Microsoft Office, Adobe products and other commonly targeted software.

Enterprise patch management: Tools like Heimdal Patch and Asset Management automate much of this process. These platforms can centrally manage updates across your entire infrastructure, automatically categorising updates by severity and ensuring critical patches are deployed within your required timeframes.

Cloud services: Cloud services often update automatically, but verify that your service provider commits to timely security updates in their service agreement.

Test automatic updates on a small group before enabling organisation-wide. Some updates can break applications or change user interfaces unexpectedly.

Create a vulnerability tracking system

You need systematic tracking to ensure nothing falls through cracks.

Vulnerability feed sources: Subscribe to security bulletins from all your software vendors. Set up alerts for new CVE announcements affecting your software stack.

Centralised asset visibility: Modern patch management solutions provide complete visibility into your software inventory. Heimdal’s asset management capabilities automatically discover all installed software across your network, making it easier to identify what needs updating when vulnerabilities are announced.

Priority classification: Sort vulnerabilities by CVSS score and vendor severity ratings. Advanced patch management systems can automatically classify vulnerabilities based on your specific software stack and business criticality.

Deployment tracking: Record when updates are tested, approved, and deployed. Track completion rates to identify bottlenecks. Automated systems provide detailed reporting on patch deployment status across all managed devices.

Exception handling: Document cases where updates can’t be applied within 14 days and what compensating controls you’re using.

Not every risk comes from missing patches. A lot of breaches now start with valid logins, which patching alone won’t stop.

What a working 14-day process looks like

• Updates identified within hours, not weeks
• Critical patches prioritised automatically
• Devices regularly checking in and updating
• Exceptions tracked and documented
• Emergency fixes handled the same day

Handle manual configuration-only fixes

Not all vulnerability fixes come as software updates. Some require manual configuration changes.

Registry modifications: Windows registry fixes need careful testing. Document exactly what changes are needed and test on isolated systems first.

Configuration file updates: Applications may require specific setting changes. Create scripts or procedures to ensure consistent application across all affected systems.

Automated configuration management: Some patch management platforms can handle configuration-based fixes alongside traditional software updates, ensuring these critical changes don’t get overlooked in your 14-day timeline.

Firewall rule updates: Network device configuration changes need coordination with your network team to avoid service disruption.

Service configuration: Changes to running services may require restart procedures during maintenance windows.

Database settings: Database configuration changes often require application downtime. Plan these carefully with stakeholders.

Create detailed procedures for each type of manual fix. Test procedures thoroughly before applying to production systems.

This is where many 14-day processes fall down.

Manage unsupported software

Unsupported software creates compliance problems because it won’t receive security updates.

Comprehensive software inventory: Use automated discovery tools to maintain a complete inventory of installed software with support status and end-of-life dates. Many organisations are surprised by how much unsupported software they’re running.

End-of-life planning: Start replacement planning at least 6 months before software support ends. Asset management systems can alert you well in advance of support expiration dates.

Immediate removal: Remove unsupported software that isn’t critical for operations. Automated software deployment tools can help with bulk removal across multiple systems.

Network isolation: If you must keep unsupported software temporarily, isolate it from internet access and limit network connections.

Risk documentation: Document business justification for keeping unsupported software and implement compensating security controls.

Replacement timeline: Create firm deadlines for replacing unsupported software. Don’t let temporary solutions become permanent.

Build testing and approval processes

Rushing updates into production without testing causes outages. But testing can’t take so long that you miss the 14-day deadline.

Test environment: Maintain test systems that mirror your production environment. Test critical updates here first.

Staged deployment: Use patch management systems that support phased rollouts. Deploy to test groups first, then gradually expand to the full organisation.

Rapid testing procedures: Develop abbreviated testing procedures for emergency security updates. Focus on functionality testing rather than comprehensive testing.

Approval authority: Define who can approve emergency security updates. Don’t require the same approval process as major software changes.

Rollback procedures: Have tested rollback procedures ready in case updates cause problems. Modern patch management tools can automate rollback processes when issues are detected.

Change communication: Notify users about upcoming security updates, especially if they might affect functionality or require restarts.

Create emergency procedures

Some vulnerabilities require immediate action, even faster than the 14-day requirement.

Threat assessment: Define criteria for treating updates as emergencies. Active exploitation or widespread automated attacks may trigger immediate response.

After-hours contacts: Maintain contact information for key personnel who can approve and implement emergency updates.

Emergency deployment capabilities: Ensure your patch management system can push emergency updates outside normal maintenance windows when necessary.

Communication procedures: Have procedures for notifying management and users about emergency updates.

Documentation requirements: Even emergency updates need documentation. Create abbreviated procedures for emergency situations.

Monitor and report compliance

Track your performance against the 14-day requirement to identify process improvements.

Metrics tracking: Monitor average time from vulnerability disclosure to deployment. Identify trends and bottlenecks. Comprehensive patch management platforms provide detailed analytics on your update performance.

Compliance reporting: Generate regular reports showing adherence to the 14-day requirement for auditors and management. Automated reporting saves significant time during compliance assessments.

Process improvement: Review cases where you missed the 14-day deadline. Update procedures to prevent similar delays.

Vendor performance: Track how quickly different vendors provide security updates. Use this information for future software selection decisions.

Asset lifecycle management: Monitor software versions across your organisation to identify systems falling behind on updates or approaching end-of-support dates.

The goal is reliable, timely security updates that protect your organisation without disrupting operations. A well-designed process handles routine updates automatically while providing clear procedures for handling exceptions and emergencies. Modern patch and asset management solutions can automate much of the heavy lifting, but you still need clear processes and oversight to ensure compliance with Cyber Essentials requirements.

If you’re not sure whether your current setup would meet the 14-day requirement, it’s worth checking before it becomes an audit point.

We can take a quick look at what you’ve got in place and highlight any gaps. No pressure, just a clear view of where things stand.