Habit 10 of 18
Devices and systems
Updates applied within two weeks
Computers, phones and software are updated within two weeks of a fix.
Attackers use known weaknesses within days of a fix being published. Prompt updates close the door.
Switch it on in the map Counts towards 5 articles, controls and categories
§1 How to do it
How a small firm does it
- Turn on automatic updates for computers, phones and browsers.
- Set a target, for example two weeks for normal updates and a few days for critical ones.
- Check monthly that devices are actually up to date.
- Replace devices and software that no longer get updates.
Evidence that shows it
- Your update policy with target times
- Update reports from your device management tool or IT supplier
Ireland: NCSC Ireland guidance on vulnerability management applies here. Irish NIS2 law is still pending.
§2 What it counts towards
What it counts towards
Most links are “supports”: doing this helps you show you meet the reference, without matching it exactly. None of them means “compliant”.
EU NIS2 Directive 2 items
-
21(2)(e) Security when buying, building and maintaining systems · supports
security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure
Applying security updates is part of maintaining systems and handling vulnerabilities, which this measure names. The implementing rules include security patch management (2024/2690, Annex §6.6).
Read Art 21(2)(e) on EUR-Lex -
21(2)(g) Basic cyber hygiene and training · supports
basic cyber hygiene practices and cybersecurity training
The recitals name software updates as a basic cyber hygiene practice (recitals 49 and 89).
Read Art 21(2)(g) on EUR-Lex
General Data Protection Regulation 1 item
-
32(1)(b) Ongoing confidentiality, integrity and resilience · supports
the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services
Fixing known weaknesses helps keep systems confidential, intact and available.
Read Art 32(1)(b) on EUR-Lex
ISO/IEC 27001:2022 1 item
-
A.8.8 Fixing technical weaknesses · supports
ISO text is copyrighted. Control number and our own description only. Not yet read against the standard.
The control is about finding and fixing technical weaknesses in good time.
About ISO/IEC 27001:2022 on ISO
NIST Cybersecurity Framework 2.0 1 item
-
PR.PS Platform security · supports
PR.PS-02: Software is maintained, replaced, and removed commensurate with risk
PR.PS-03: Hardware is maintained, replaced, and removed commensurate with risk
Keeping software and hardware updated is maintaining them in line with the risk.
Read PR.PS-02, PR.PS-03 on NIST
§3 Questions it answers
Indicative mapping, written by hand from public sources. Not legal advice and not a compliance test. Check anything important against the official texts.