Citadel / Controls / AutoUpdates

AutoUpdates Control

What does this control check?

The AutoUpdates control verifies that your operating system is configured to automatically download and install security updates. This ensures your computer stays protected without requiring you to manually check for and install updates.

Important: Manual updates aren't enough. Security vulnerabilities are discovered constantly, and attackers often exploit them within hours of their disclosure. Automatic updates ensure critical security patches are installed as soon as they're available, protecting you even when you're busy or forget to check manually.

Why is this important?

⚡

Immediate Protection

Security vulnerabilities are often exploited within hours of being discovered. Automatic updates ensure you're protected as quickly as possible without waiting for manual intervention.

🔄

Consistent Coverage

Automatic updates work even when you're busy, on vacation, or simply forget to check. This ensures continuous protection without gaps in your security coverage.

🛡️

Zero-Day Protection

When critical zero-day vulnerabilities are discovered, automatic updates can deploy emergency patches immediately, protecting you from attacks before they become widespread.

How to fix this

Enabling Automatic Updates on Windows

  1. Click the Start button and select Settings
  2. Click Windows Update (or Update & Security on older versions)
  3. Click Advanced options
  4. Under "Additional options", ensure the following are enabled:
    • "Receive updates for other Microsoft products" - Turn this on
    • "Download updates over metered connections" - Consider enabling if you have sufficient data
  5. Go back and verify "Automatic updates" is set to on
Note: Windows 10 and 11 have automatic updates enabled by default. If you see options to disable it, make sure they remain in the "on" position.
⚠️ Important notes:
  • Windows may automatically restart to install updates - save your work regularly
  • You can set "Active hours" to prevent restarts during your work time
  • Some updates require you to manually restart - don't postpone these indefinitely
  • Keep your computer connected to power and the internet regularly to receive updates

Enabling Automatic Updates on macOS

  1. Click the Apple menu in the top-left corner
  2. Select System Settings (or System Preferences on older versions)
  3. Click General and then Software Update
  4. Click the ⓘ icon next to "Automatic updates"
  5. Enable all the following options:
    • "Check for updates"
    • "Download new updates when available"
    • "Install macOS updates"
    • "Install application updates from the App Store"
    • "Install Security Responses and system files"
  6. Click Done
Note: On older macOS versions, these options are found in System Preferences → Software Update → Advanced button.
⚠️ Important notes:
  • macOS automatic updates are disabled by default - you must enable them
  • Your Mac will notify you when a restart is needed to complete updates
  • Major macOS upgrades may still require manual approval
  • Keep your Mac connected to power and WiFi regularly, especially overnight

Enabling automatic updates on Linux

Debian / Ubuntu:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

# ensure /etc/apt/apt.conf.d/20auto-upgrades contains:
#   APT::Periodic::Unattended-Upgrade "1";

sudo systemctl enable --now apt-daily-upgrade.timer

Fedora / RHEL / CentOS:

sudo dnf install dnf-automatic

# in /etc/dnf/automatic.conf, set:
#   apply_updates = yes

sudo systemctl enable --now dnf-automatic.timer
⚠️ Important notes:
  • Other distribution families (e.g. openSUSE transactional-update, Fedora Silverblue/CoreOS rpm-ostree) have their own equivalent timers — check your distribution's documentation if the above doesn't apply
  • Automatic security updates can still require a reboot to take effect (see the SystemUpdated control)

Verifying the fix

After enabling automatic updates, Citadel will automatically verify this control during its next check.

To check automatic update settings:

  1. Open Settings → Windows Update
  2. Click Advanced options
  3. Verify that automatic updates are enabled
  4. Check that "Receive updates for other Microsoft products" is on
  5. Return to Windows Update and click Check for updates to ensure it's working

To check automatic update settings:

  1. Open System Settings → General → Software Update
  2. Click the ⓘ icon next to "Automatic updates"
  3. Verify that all automatic update options are checked
  4. Click Done
  5. The main Software Update screen should show when updates were last checked

To check automatic update settings:

# Debian / Ubuntu
systemctl is-enabled apt-daily-upgrade.timer
systemctl is-active apt-daily-upgrade.timer

# Fedora / RHEL / CentOS
systemctl is-enabled dnf-automatic.timer
systemctl is-active dnf-automatic.timer