We describe the challenges addressed by the three year German national collaborative research project Step-Up!CPS that is currently in its third year. The goal of the project is to develop software methods and technologies for modular updates of safety-critical cyber-physical systems. To make this possible, contracts are utilized, which formally describe the behaviour of an update and make it verifiable at different times of the update life cycle. We have defined a development process that allows for a continuous improvement of such systems by monitoring their operation, identifying the need for updates, and development and deploying these updates in a safe and secure manner. We highlight the points along the update process that are necessary for a secure update and show how we counteract them in a contractually secured update process.