Cyber Essentials requires critical patches applied within 14 calendar days across your entire estate. Most Azure teams are patching. Far fewer can demonstrate it clearly, consistently, and without a last-minute scramble.
Cyber Essentials is a UK government-backed certification scheme covering five technical controls. The fifth — Security Update Management — is consistently the leading cause of assessment failure. The requirement itself is not complicated. Meeting it in practice, across a real Azure estate, with evidence to back it up, is where most teams run into difficulty.
All software must be licensed, supported, and have high-risk or critical security patches applied within 14 calendar days of release.
This applies to operating systems, applications, firmware on network devices, and browser plugins — across every device within the scope of your certification. It is 14 calendar days, not business days. And the clock starts from the date the vendor releases the patch, not from the date you become aware of it.
Microsoft releases security patches on the second Tuesday of each month. From that date, you have 14 calendar days to apply any high-risk or critical updates across your entire in-scope estate. If your assessment falls on day 15, and any device is missing a critical patch from that cycle, you fail.
The April 2026 update to Cyber Essentials — version 3.3, known as the Danzell scheme — introduced automatic failure conditions for patching. Under the previous scheme, a patching non-compliance was a major finding that could still allow certification with up to two strikes. That loophole is now closed.
If an assessor finds even a single device in their sample missing a critical or high-risk update older than 14 days, the assessment fails automatically. No partial credit, no negotiation.
If the first device sample fails, the assessor takes a second random sample from the rest of the estate. If that also fails, the assessment fails entirely — and any existing CE certificate can be revoked.
Recent audits caught organisations patching only the devices likely to be sampled. The 2026 rules specifically address this — assessors now verify consistent patching across the entire scope, not just the sample.
From April 2026, cloud services cannot be carved out of your CE scope. If your organisation runs servers on Azure, those servers are in scope and must meet the same 14-day patching requirement.
The practical effect is that patching is no longer something you can tighten up in the weeks before an assessment. The requirement must be met continuously — and the evidence must exist to prove it was met at the time of assessment, not assembled retrospectively.
Most Azure teams running Azure Update Manager are patching reasonably well. The 14-day window is achievable if you have a structured monthly process aligned to Patch Tuesday. The problem is not usually the patching itself — it is demonstrating that it happened, when it happened, across every device in scope, in a form the assessor can verify.
When an assessor asks for patch compliance evidence, here is the difference between what most teams can produce and what a well-structured process produces:
OPUS was not built as a CE compliance tool. It was built by an engineer who ran enterprise patch cycles at scale and needed a structured, governed process that left a proper audit trail. The alignment with Cyber Essentials is a natural result of that — if your patching process is structured correctly, the CE evidence exists as a by-product. You are not doing extra work for the auditor.
Assessor data consistently shows the same pattern: organisations pass their initial CE assessment with patching well under control, and then fail the renewal 12 months later. Not because anything fundamentally changed, but because patching discipline drifted — quietly, gradually, over the course of a year.
None of the steps above are unusual. They happen in real organisations every year. The pattern is not negligence — it is the natural result of a manual process that depends on consistent human attention over a 12-month period. OPUS's Autonomous Mode removes that dependency. The patch cycle runs every month because the system runs it, not because someone remembered to.
The 2026 Danzell update introduced an expectation that each legal entity within a group may require its own CE certificate. For MSPs managing multiple client environments, this means CE compliance is not a one-time achievement — it is a continuous operational requirement across every client, every month.
Each client environment needs a demonstrable, auditable patching process that can produce compliance evidence on demand. Manually managing this across ten client tenants — separate portal sessions, separate compliance exports, separate audit trails — multiplies the effort by ten and creates ten separate points of failure.
OPUS manages unlimited tenants from a single interface. Each tenant has its own isolated compliance history, its own activity audit log, and its own ITSM integration if required. Producing CE-ready patch compliance evidence for any client, for any previous month, is the same 30-second export regardless of how many clients you manage.
The governed workflow runs identically across every tenant. The process scales with your client base — the work doesn't.
OPUS structures your Azure patching process around Patch Tuesday, captures compliance history automatically, and produces the audit-ready evidence your assessor expects — without any additional effort on your part. 90-day free trial, no device cap, no payment details required.
90-day free trial. No payment details required.