In short: any supplier whose systems touch your business can expose you if they fall behind on security updates. That includes suppliers who look after your technology, like your website host or IT provider, and those who hold your data or connect to your network, like a payroll provider or a software vendor with remote access. Ask each one who updates what, how quickly and how they'll tell you about alerts. A good answer gives a timescale, never longer than the 14 days Cyber Essentials allows for critical updates, and much faster when a flaw is being actively exploited.
The NCSC expects a “patch wave”: a rush of security updates across all kinds of software, as AI makes flaws easier to find. It advises organisations of every size to prepare to apply updates more quickly and more often than they're used to.
The recent critical PHP vulnerability showed what that looks like. In our earlier posts on the critical PHP vulnerability and on AI finding security flaws faster, the main action for most readers was to ask their web developer, hosting provider and software suppliers whether they ran PHP and whether it had been updated. The risk wasn't limited to your own website, either. Any supplier running a portal or platform on PHP could have put your data at risk.
If every alert means chasing suppliers from scratch, you lose days you may not have. Agree the answers now, and the next alert becomes a quick check rather than a hunt.
Who is responsible for updating what?
It depends on what the supplier provides, and it's often less clear-cut than people assume.
For cloud services, Cyber Essentials splits responsibility between the provider and the customer in the same way. You don't need to take the work back from your suppliers. You just need every piece to have a named owner.
What should you ask your suppliers?
Eight questions cover most of it. Send them by email, so you have the answers in writing.
Do you hold Cyber Essentials? It's a quick check that the basics were in place when they were assessed, including how quickly they apply critical updates.
A good answer is specific and has a timescale. “We keep everything up to date” tells you nothing. “We apply critical and high-risk updates within days for anything actively exploited, and we'll email you when one affects your service” gives you something you can check.
The 14 days comes from the Cyber Essentials requirements, which say critical and high-risk security updates must be applied within 14 days of release. That's the maximum, not the target. The NCSC says updates should be accelerated when a critical flaw is being actively exploited, especially on internet-facing systems, so a good supplier should be acting within days.
Other good signs are a named contact, a clear statement of what's in and out of scope, and a plan for anything nearing the end of support.
What if the answers aren't good enough?
Don't assume the worst straight away. Some suppliers have simply never been asked, and a clear question often gets a clear answer the second time. If it doesn't:
Sometimes the honest answer is that nobody is responsible. This is common with websites built years ago by an agency you no longer work with. In that case, you may need a web developer rather than an IT provider. If you're not sure who should own what, get in touch and we'll help you work it out.
Can a supplier's security problem affect my business? Yes. If a supplier holds your data or has access to your systems, a flaw in their software can expose you even if your own systems are fully up to date. That's why it's worth asking every supplier how they handle security updates, not just your IT provider.
Who is responsible for security updates on my website? It depends on your contract. Your hosting provider may update the server, but the website itself, and any plugins, are often only updated if a developer or agency is contracted to do it. Ask both, and get the answer in writing.
How quickly should suppliers apply security updates? As fast as possible when a critical flaw is being actively exploited, especially on internet-facing systems, which the NCSC says should be prioritised. The outer limit is 14 days: Cyber Essentials requires critical and high-risk security updates to be applied within that time.
What should I ask my hosting provider about security updates? Ask what they update and what they don't, how quickly they apply critical updates, how they'll tell you about alerts that affect you, and whether anything they host for you is out of support.
What if my supplier can't or won't answer? Agree any gaps in writing and check what your contract covers. If a supplier holds your data and still can't give you clear answers, consider whether they're the right supplier.
Does Cyber Essentials cover the services my suppliers run? Your Cyber Essentials certification covers the IT your business uses to do its work, including cloud services, where some controls sit with the provider and some with you. It doesn't cover a supplier's own internal systems, which is why it's worth asking whether they hold Cyber Essentials themselves.