Skip to content
Made in the UK

Vulnerability Remediation

How do MSPs meet the 14-day remediation rule across every client?

By , CEO, CybaVerse. Last reviewed

MSPs meet the 14-day rule by applying security updates continuously, not monthly: automatic updates where possible, daily scanning for missing critical and high fixes, out-of-cycle deployment when a qualifying fix lands, and evidence of each fix. The clock starts at vendor release.

This page is part of our vulnerability remediation guide for MSPs.

What does the 14-day rule actually say?

Cyber Essentials requires critical and high-risk fixes (or CVSS v3 7 and above, or unrated fixes) to be applied within 14 days of vendor release on all in-scope devices. Since April 2026 the security update questions are auto-fail, so one missed qualifying fix can fail an assessment.

Under the Cyber Essentials requirements, software on in-scope devices must be licensed and supported, have automatic updates enabled where possible, and be updated within 14 days of release where the update fixes vulnerabilities the vendor rates as critical or high risk, has a CVSS v3 base score of 7 or above, or comes with no severity details at all. Vulnerability fixes include patches, registry fixes, configuration changes and scripts prescribed by the vendor. Since the April 2026 update, the two security update questions (operating systems and firmware, and applications) are auto-fail questions. Check the current NCSC requirements and IASME update for the version that applies to each client's assessment.

Why do MSPs struggle with the 14-day rule?

MSPs struggle because software updates across many clients fails in small, silent ways: failed installs, servers waiting for reboot windows, macOS and Linux gaps, third-party apps outside RMM policy, and configuration fixes that software updates cannot apply. Each gap is minor, but together they break the deadline.

From partner and prospect calls, the recurring problems are consistent:

  • Patches fail silently and nobody notices until the next scan or the assessment.
  • Servers cannot be rebooted mid-week, so fixes wait for a maintenance window.
  • macOS and Linux estates are harder to patch than Windows.
  • Third-party applications sit outside the RMM's patch policy.
  • Clients leave critical software updates until just before their Cyber Essentials Plus audit.
  • Some vulnerabilities are configuration or registry issues that software updates alone do not fix.

How do you meet the 14-day rule, step by step?

These eight steps turn the 14-day rule into a continuous process. They move from scope and automatic updates through daily scanning, prioritisation, out-of-cycle deployment, verification and evidence, so each client is always assessment-ready rather than patched in a rush before renewal.

  1. Step 1: Define the in-scope estate for each client

    List every device, operating system, firewall, router and cloud service in scope. You cannot hit a deadline on assets you do not know about.

  2. Step 2: Turn on automatic updates wherever possible

    Operating systems, browsers and common applications should update themselves. Reserve manual handling for servers and line-of-business software that genuinely need change control.

  3. Step 3: Scan continuously, not quarterly

    Run vulnerability scanning on every device at least daily so new critical and high findings surface within a day of being detectable. Agent-based scanning works for laptops that rarely sit on the office network.

  4. Step 4: Filter for what the rule cares about

    Filter findings to critical and high severity, and CVSS 7 or above. Sort by number of affected assets, because one fix that clears 30 devices does more than one that clears a single machine.

  5. Step 5: Set a deployment plan with out-of-cycle capacity

    Patch Tuesday cycles alone can miss the window when a qualifying fix lands between scheduled runs. Agree a fast lane for critical updates, including a pre-agreed server reboot window that fits inside 14 days.

  6. Step 6: Track failures and re-verify

    After deployment, rescan to confirm the vulnerability is gone. Anything still present goes back on the list with the device named, so failed patches do not hide.

  7. Step 7: Handle what software updates cannot fix

    Unsupported software must be removed or moved out of internet-connected scope. Configuration and registry fixes need their own workflow.

  8. Step 8: Keep evidence as you go

    Keep a record of when each qualifying fix was released, detected and confirmed fixed. Exports and reports from your tooling are simpler than collecting screenshots at assessment time.

Where does CybaOps fit in software updates?

CybaOps does not deploy patches; your RMM keeps doing that. CybaOps gives MSPs continuous vulnerability scanning and prioritisation across every client tenant, so you know what is outside the 14-day window and what to fix first, and the Remediation Engine can fix security issues automatically.

  • CybaVM gives continuous internal and external vulnerability scanning, prioritised in one place in CybaOps.
  • Vulnerability scanning in CybaOps is powered by Qualys.
  • Internal scans run several times a day and external scans run daily.
  • CybaOps ties vulnerabilities to the assets they affect, so teams fix what matters first.
  • MSPs can run CybaOps across all their customers from one multi-tenant platform.
  • Vulnerability data can be exported from CybaOps reports.
  • The CybaOps Remediation Engine is live today: it can fix security issues automatically, so gaps get closed rather than just reported.

The automation side is covered in How to automate vulnerability remediation workflows.

14-day rule

How MSPs hit the 14-day update window

How MSPs hit the 14-day update window.

01 Findings from

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

14-day rule

02 The 8-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • Remediation in
  • CybaVM
  • CybaRemediate

What else do MSPs ask about the 14-day rule?

These are the questions MSP engineers and service managers ask most about meeting the Cyber Essentials security-update deadline.

When does the 14-day clock start?

At the vendor's release of the fix, not when your scanner detects the missing update or when a ticket is raised. Track vendor release dates for qualifying updates so you can see how much of the 14-day window remains for each client.

Does the rule apply to every update?

It applies to updates that fix critical or high-risk vulnerabilities, CVSS v3 7 or above, or updates with no severity details. Applying all updates within 14 days is recommended but not mandatory.

Is a monthly patch cycle enough?

Not on its own. A fix released just after Patch Tuesday could exceed 14 days before the next cycle, so you need an out-of-cycle process.

Is traffic-filtering workarounds acceptable?

The CE+ test specification says traffic-filtering workarounds is not an acceptable long-term mitigation for legacy unsupported operating systems. Treat it as a short-term control at most, and plan to upgrade or remove unsupported systems so they no longer sit in scope unpatched.

What evidence should we keep?

Records showing release date, detection and confirmed fix for qualifying updates, such as vulnerability exports and reports. Keep them for each client in one consistent place, so you can show an assessor exactly when each fix was released, found and confirmed as applied.

What should you do next?

See vulnerability management on the CybaOps Platform page. MSPs can read about delivering it to clients on the Partner page.

Related: How do you stay Cyber Essentials compliant all year, not just at renewal? and How do you prioritise vulnerabilities: severity, CVSS or number of affected assets?

See continuous vulnerability scanning and the Remediation Engine across client tenants.

Book a CybaOps demo