What are the Cyber Essentials Plus patching requirements?

As of 24 January 2022, software updates need to be applied within 14 days of release, where the update fixes address vulnerabilities described by the vendor as ‘critical’ or ‘high risk’ or where no level of vulnerabilities is provided by the vendor, or where the fixes address vulnerabilities with a CVSS v3 score of 7 or above.

For password-based authentication in Internet-facing services, you must:

• Protect against brute-force password guessing by using at least one of the following methods:
  
  • Lock accounts after no more than 10 unsuccessful attempts
  • Limit the number of guesses allowed in a specified time period to no more than 10 guesses within 5 minutes
• What is the required Cyber Essentials password policy?
• Set a minimum password length of at least 8 characters and use automatic blocking of common passwords via a deny list
• Set a minimum password length of at least 12 characters
• Use multi-factor authentication
• Not set a maximum password length
• Change passwords promptly when you know or suspect that you have been compromised‍
• Implement a password policy that tells users:‍
  
  • How to avoid choosing obvious passwords (such as those based on easily discoverable information like the name of a favourite pet)
  • Not to choose common passwords — this could be implemented by technical means, using a password deny list
  • Not to use the same password anywhere else, at work or at home
  • Where and how they may record passwords to store and retrieve them securely (for example, in a sealed envelope in a secure cupboard), whether they may use password management software, which software, and how to use it
  • Which passwords they must memorise.

You are NOT required to:

• Enforce regular password expiry for any account (we actually advise against this)
• Enforce password complexity requirements.