A single unpatched device rarely causes a breach on its own. It’s the one left running an outdated browser plugin, the printer firmware nobody’s touched in two years, the laptop still on last year’s operating system, sitting quietly until something finds it. Patching is the least exciting item on this list and the one that closes the most doors.
The 14-day rule
The DfE’s Cyber Security: Core Standard is clear about patching, and sets an actual clock:
- Vulnerabilities rated critical or high severity (a CVSS v3.1 score of 7.0 or above, or anything the vendor gives no rating for) must be patched within 14 days of release.
- Security updates flagged directly by the DfE must be applied within 5 working days of notification.
- Where a patch genuinely isn’t available yet, the standard’s answer isn’t “wait”, it’s isolate the device: take it off the network until it can be fixed safely.
- End-of-support dates for operating systems should be logged in the asset register, and licences reviewed termly, not discovered when something stops working.
This replaces last year’s general “don’t postpone critical patches” advice with something your IT support (internal or outsourced) can actually be measured against, and something governors can actually ask about without needing to understand the technical detail underneath it.
Why this year’s advice is clearer
In mid-2026, the NCSC issued a specific warning: AI tools are now accelerating how fast attackers can find and exploit the backlog of unpatched vulnerabilities sitting in ordinary commercial, open-source, and SaaS software; what the NCSC calls accumulated “technical debt.” Their expectation is a coming “vulnerability patch wave”: a rush of critical fixes across widely-used software, arriving faster and more often than organisations have historically been used to.
Their recommended response moves beyond “patch promptly” into genuinely practical territory:
- Know your external attack surface first. Identify anything internet-facing before anything else, that’s where speed matters most.
- Adopt “update by default.” Apply updates as soon as they’re available, automatically wherever possible, rather than batching them into a termly cycle.
- Prepare to patch faster and more often, including in your supply chain. This is the point that matters most for schools: your risk doesn’t stop at your own devices.
Controlling what gets installed
Patching fixes vulnerabilities after the fact. The DfE standard also expects schools to reduce how many vulnerabilities exist to patch in the first place, by controlling what software and devices get onto the network at all:
- Maintain an approved application list and verify software comes from known, legitimate suppliers.
- Remove software that’s no longer needed . Every unused application is something that still needs patching for no ongoing benefit.
- Lock down browser settings so staff and pupils can’t install extensions or bypass filtering and security controls.
- Keep USB storage blocked by default, with any approved exceptions scanned before use.
None of this is about distrust of staff, it’s about not multiplying the number of places a vulnerability can sit unnoticed.
Where this connects to supplier due diligence
The NCSC’s patch-wave warning explicitly tells larger organisations to seek assurance that their commercial and open-source suppliers are ready to respond to a sudden rush of critical updates, not just assume the supplier will handle it quietly in the background. That’s the same logic behind the DfE’s Cloud Solutions standard requiring a data sharing agreement and prompt breach notification from cloud providers, and it’s the same question a Data Governance Lead or DPO should already be asking when a new supplier or system is brought in: if this vendor has to patch something critical next month, how would we know, and how fast would it happen?
A supplier who can’t answer that question with any confidence is a patching risk you’ve inherited without choosing it.
Who’s accountable
IT support is Responsible for actually applying patches, maintaining the approved application list, and isolating unpatched devices when needed. The SLT digital lead is Accountable for making sure the 14-day and 5-day clocks are actually being met, and for signing off the asset register and licence reviews. The data protection lead is Consulted wherever unpatched systems touch personal data. Governors are Informed, and entitled to ask whether the school’s critical suppliers have been asked the same “are you ready to patch fast?” question the NCSC is now asking of everyone.
💡Daily Cyber Tip
Ask whoever manages your patching: “What’s currently outside the 14-day window, and why?” A clean answer is reassuring. A vague one is the actual finding.
Further reading
DPE’s free micro-learning videos on updates and patch management remain available, alongside the Digital Standards Tracker for monitoring progress against all of the DfE’s standards, not just this one.