What are the Cyber Essentials Plus patching requirements?

As of 24 January 2022, software updates need to be applied within 14 days of release, where the update fixes address vulnerabilities described by the vendor as ‘critical’ or ‘high risk’ or where no level of vulnerabilities is provided by the vendor, or where the fixes address vulnerabilities with a CVSS v3 score of 7 or above.

For password-based authentication in Internet-facing services, you must:

  • Protect against brute-force password guessing by using at least one of the following methods:
    • Lock accounts after no more than 10 unsuccessful attempts
    • Limit the number of guesses allowed in a specified time period to no more than 10 guesses within 5 minutes
  • What is the required Cyber Essentials password policy?
  • Set a minimum password length of at least 8 characters and use automatic blocking of common passwords via a deny list
  • Set a minimum password length of at least 12 characters
  • Use multi-factor authentication
  • Not set a maximum password length
  • Change passwords promptly when you know or suspect that you have been compromised
  • Implement a password policy that tells users:
    • How to avoid choosing obvious passwords (such as those based on easily discoverable information like the name of a favourite pet)
    • Not to choose common passwords — this could be implemented by technical means, using a password deny list
    • Not to use the same password anywhere else, at work or at home
    • Where and how they may record passwords to store and retrieve them securely (for example, in a sealed envelope in a secure cupboard), whether they may use password management software, which software, and how to use it
    • Which passwords they must memorise.

You are NOT required to:

  • Enforce regular password expiry for any account (we actually advise against this)
  • Enforce password complexity requirements.
During our Cyber Essentials accreditation process we found URM to be very helpful and engaging ensuring that we can demonstrate our commitment to cyber security for both our partners and customers. We would recommend URM to other organisations that seek Cyber Essentials accreditation.
IT consultancy
Apply for Cyber Essentials certificationApply for Cyber Essentials Plus

Supplementing Cyber Essentials

Published on
11 Jul
2025

URM’s blog outlines the practical measures you can take following Cyber Essentials certification to further enhance your information & cyber security posture.

Read more
Thumbnail of the Blog Illustration
Cyber Security
Published on
3/7/2025
Understanding Lexcel and the Specialist Quality Mark (SQM): How Cyber Essentials Can Benefit Your Practice

URM’s blog explores how Cyber Essentials can help your legal practice enhance its security posture and achieve/maintain its SQM or Lexcel accreditation.

Read more
Thumbnail of the Blog Illustration
Cyber Security
Published on
26/6/2025
Cyber Essentials Questions Answered: Technical Requirements, BYOD Compliance and the Future of the Scheme

URM’s blog answers key questions about CE, focusing specifically on its technical requirements, use of BYOD, and how the scheme may change in the future.

Read more
Thumbnail of the Blog Illustration
Cyber Security
Published on
16/6/2025
Lexcel: Deconstructing Your Information Management and Security Policy

URM explains each control law firms must include in an information management and security policy that complies with the Lexcel Practice Management Standard.

Read more
"
The speed of response from our URM Account Manager was stunning, and the speed and helpfulness of our assessor was very impressive.
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.