Short answer
Apply qualifying fixes within 14 days of vendor release: those addressing vendor-rated high or critical vulnerabilities, a CVSS v3 base score of at least 7, or vulnerabilities whose severity the vendor does not describe. A bundled update inherits that deadline if it contains a qualifying fix. A monthly maintenance window is insufficient whenever it misses that deadline; plan an expedited route.
Why this matters
Technical-control questions decide whether the self-assessment can be approved. Cyber Essentials is not a paper-only exercise: the applicant must be able to show that secure configuration, patching, access control, malware protection, and firewalls are implemented in the actual environment.
The strongest submissions use evidence from device management, endpoint security, vulnerability scanning, identity controls, and asset registers. If a control is implemented manually, the organisation should still be able to explain ownership, frequency, and how exceptions are handled.
What to check next
- Apply every qualifying high-risk, CVSS v3 7+ or unspecified-severity fix within 14 days of release.
- Remove unsupported software or agree the permitted isolated subset with the assessor.
- Keep endpoint protection, firewall rules, and admin accounts documented.
Official sources and related Fig Group guidance
For scheme-level confirmation, use the official NCSC and IASME resources. Fig Group links to these sources so Cyber Essentials buyers can verify the scheme, delivery partner and certificate record independently.