Keep devices, software and cloud services up to date – what must be patched, how quickly, who is responsible, how unsupported software is handled, and records to prove it – aligned with Cyber Essentials.
IT & cyber security
Patch and Vulnerability Management Policy
About this document
Most successful cyber attacks exploit known weaknesses in software that has not been updated. Cyber Essentials requires critical and high-risk security updates to be applied within 14 days and unsupported software to be removed or isolated. This policy sets out how your business keeps everything patched, and gives you an inventory, a patch log and an exceptions register to prove it.
The document is laid out in the sections below. Each one comes with a plain-English guidance note explaining what it does and what to change.
Our templates are professionally structured starting points for UK businesses, not legal advice. For anything complex, unusual or high-value, have your final version checked by a solicitor.
Included in the pack
IT & cyber security
for every document in this category
Editable Microsoft Word files
Guidance notes in every document
Written for UK businesses
Download and keep
Need more than one category?
Documents All-Access gives you every category for 12 months for £295.
Compare options →Need it tailored?
We can adapt any template to your business, or write a document from scratch.
Talk to us →
