Cyber Essentials and Unsupported Software: What the Scheme Requires, and How to Prove It
Cyber Essentials is stricter about end-of-life software than most frameworks. Where others ask for a review, a risk decision or a remediation plan, the NCSC's Requirements for IT Infrastructure v3.3, in force since April 27, 2026, say that all software on in-scope devices must be licensed and supported, and must be removed when it becomes unsupported or moved into a defined sub-set that blocks all traffic to and from the internet. There is no compensating control and no plan that stands in for it. IASME's question set puts it plainly for operating systems: an in-scope device on an unsupported operating system, with no regular vulnerability fixes from the vendor, means "you will not be awarded certification" (IASME, Danzell question set). On top of that sits the 14-day rule for critical and high-risk updates, now an automatic-fail question.
What the requirements say about unsupported software
Cyber Essentials has five technical controls. End-of-life software is dealt with in the third, Security Update Management, and in the scope rules and definitions that frame it. The wording below is paraphrased from the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026), with the matching questions from IASME's Danzell self-assessment question set.
| Where | What it says (paraphrased) | What it means for end-of-life software |
|---|---|---|
| Definitions: licensed and supported | Software you have a legal right to use, from a vendor that has committed to support it with regular vulnerability fixes and has given the future date when those fixes will stop. The vendor does not have to be the original author, but must be able to modify the software to create fixes. | Support is defined by a commitment to regular fixes with a published end date. A product past that date is unsupported, whatever state it is in. |
| Definitions: software | Operating systems, commercial off-the-shelf applications, extensions, interpreters, scripts, libraries, network software, and firewall and router firmware. | The rule reaches well past Windows: a browser extension, a PHP interpreter on a web server and the firmware in the office router are all software. |
| Security Update Management | All software on in-scope devices must be licensed and supported; must be removed from devices when it becomes unsupported, or removed from scope by a defined sub-set that prevents all traffic to or from the internet; must have automatic updates enabled where possible; and must be updated within 14 days of release where the update fixes critical or high-risk vulnerabilities. | Three exits only: remove it, keep it supported, or isolate it out of scope. Question A6.6 asks whether you have removed it; A6.7 asks how you moved anything you still need out of scope. |
| Scope | Certification covers the whole IT infrastructure or a well-defined, separately managed sub-set, agreed with the Certification Body. A sub-set is part of the organisation whose network is segregated from the rest by a firewall or VLAN. Exclusions must be justified to the assessor. A scope without end-user devices is not acceptable, and cloud services cannot be excluded. | You cannot scope around a fleet of old laptops, and a hosted service your data lives in is in scope by definition. |
| Applies to | Servers, desktop computers, laptops, tablets, mobile phones, firewalls, routers, and IaaS, PaaS and SaaS. | Phones and tablets count. IASME's question set gives older mobile operating systems as examples of systems out of regular support, alongside old Windows versions. |
Three details that decide most cases
- The end date has to exist. The definition says the vendor "must provide the future date" when fixes will stop (NCSC, Requirements for IT Infrastructure v3.3). Most enterprise vendors publish one. Where a vendor publishes no end date at all, ask your Certification Body how it will be treated before the assessment, not during it.
- Support can come from someone other than the original vendor. The same definition accepts a vendor that did not write the software, provided it can modify it to create fixes. That is the opening for third-party extended support. Whether a particular provider meets the definition is your Certification Body's call; keep the contract, the published end date of the coverage and the fix history ready.
- It is checked item by item. The question set asks you to list browsers, malware protection, email applications and office applications with their versions so the assessor can check they are in support (A6.2.1 to A6.2.4), and to give the edition and feature version of every Windows device (A2.6). It adds that frameworks and extensions are included.
The 14-day rule, and why end-of-life software cannot meet it
The update requirement is narrow and hard. All software on in-scope devices must be updated, including vulnerability fixes, within 14 days of release where any one of these is true:
- the update fixes vulnerabilities the vendor describes as critical or high risk;
- the update addresses vulnerabilities with a CVSS v3 base score of 7 or above;
- the vendor gives no details of the level of the vulnerabilities the update fixes.
Two clarifications in the same section matter in practice. If a vendor bundles fixes of mixed severity into one update and any of them is critical or high risk, the whole update falls under the 14 days. And applying every other update within 14 days is strongly recommended but not mandatory. In the question set, A6.4 (operating systems and router and firewall firmware) and A6.5 (applications, including associated files and extensions) are marked as automatic fails if the answer is no; IASME announced that change in its notice of the 2026 scheme updates.
The 14-day rule assumes there is something to install. Once a product reaches end of support, the vendor stops releasing fixes for it, while new vulnerabilities affecting it can still be found and published. There is nothing for the clock to measure, so the requirement that catches end-of-life software is the first one, licensed and supported. The 14-day rule is the reason that requirement exists. The Cyber Essentials Plus test specification closes the obvious workaround: virtual patching, it says, is not an acceptable long-term mitigation for legacy unsupported operating systems and is not recognised as a way to comply (NCSC, Cyber Essentials Plus Test Specification v3.2).
Sub-sets: the only way to keep unsupported software
Sometimes the old system has to stay: a laboratory instrument controlled by a Windows 7 PC, a CNC machine, a line-of-business application with no supported version. Cyber Essentials allows it only outside the scope, and only behind a real boundary.
- Build the boundary with a firewall or VLAN. IASME's question set says other methods, naming security groups, microsegmentation and software-based methods, are not compliant, and that a software firewall built into an operating system cannot define the scope boundary.
- Cut the internet. The requirement is a sub-set that prevents all traffic to or from the internet. The question set adds that if an out-of-scope sub-set stays connected to the internet, the organisation cannot certify as a whole and has to answer "Partial Organisation".
- Describe it. Excluded networks are described in the self-assessment (A2.2.1, not made public), along with how each sub-set was built (A2.2.2) and the equipment that creates it (A2.5.1).
- Expect it to be tested. For Cyber Essentials Plus, the assessor has to verify by technical means that sub-sets are effectively segregated before testing starts.
A partial scope has a commercial cost too. The NCSC's resources page says the free cyber liability insurance arranged by IASME is for organisations certifying their whole organisation (with a turnover limit). An out-of-scope machine that keeps its internet access takes the whole-organisation certificate, and that insurance, with it.
Paid Extended Security Updates: what the scheme accepts
The NCSC requirements document does not mention Extended Security Updates by name; its definition of support does the work. IASME's question set is explicit for operating systems: for any end-of-life operating system that has an extended security update program, you must maintain the required subscription, and Windows 10 used after its end of support must be signed up to Microsoft's ESU program to remain compliant (A2.6 and A6.1). IASME's Knowledge Hub says the same and adds a warning: Cyber Essentials allows ESU to maintain compliance, but relying on legacy systems is not a sustainable strategy.
Two scheme changes announced by IASME for 2026 sharpen this. The "point in time" of the assessment is the date the certificate is issued, so systems must be supported on that day. And the declaration signed by a board member or director now acknowledges responsibility for keeping every control in place for the whole certification period. An ESU subscription that lapses, or a product that reaches end of support, in the middle of the certificate year is a compliance problem from that day, not at renewal.
For applications the question set says nothing specific about ESU; Microsoft's paid program for Exchange Server is the common case. There the test is the definition, a vendor committed to regular fixes with a published end date, and the deciding voice is your Certification Body's. Ask before you rely on it.
A worked example: what UK organisations still run
Here is how common products look against the scheme today. The dates and status badges in this table are refreshed from our lifecycle data at every build, so they stay current when a vendor moves a date.
| Component | End-of-life date | Status | What it means for Cyber Essentials |
|---|---|---|---|
| Windows 10 22H2 | Oct 14, 2025 | EOL | Compliant only while enrolled in Microsoft's ESU program, which requires version 22H2. For organisations it is bought a year at a time and runs for at most three years after end of support. The consumer program has its own end date; see how that date moved. Without ESU: upgrade, replace, or isolate. |
| Windows Server 2012 R2 | Oct 10, 2023 | EOL | Microsoft's paid ESU for it covers updates to Oct 13, 2026. After that there is no vendor fix stream, so a server still running it has to leave scope behind a sub-set with no internet access, or go. |
| Windows Server 2016 | Jan 12, 2027 | Approaching | A certificate issued while it is still supported can outlive its support. Under the declaration of ongoing compliance, the upgrade, or a paid security update subscription your Certification Body accepts, has to be in place by its end date. |
| Office 2016 | Oct 14, 2025 | EOL | Office applications are listed by version in A6.2.4. Past its end date with no ESU program, it has to be removed from in-scope devices or replaced with a supported version. |
| Office 2019 | Oct 14, 2025 | EOL | Same position as Office 2016. Check the version actually installed, not the licence: perpetual-licence Office often survives on machines that were moved to Microsoft 365. |
| Office 2021 | Oct 13, 2026 | EOL | The newest of the three to reach its end date. A renewal assessment is the moment it gets found, so check before the questionnaire. |
| Exchange Server 2016 and 2019 | Oct 14, 2025 | EOL | Exchange is the question set's own example of an email application to list (A6.2.3). Microsoft ran a paid ESU program for both versions, its last announced period ending in October 2026. Agree with your Certification Body whether ESU coverage counts, and plan the move to a supported mail platform. |
| PHP 8.1 | Dec 31, 2025 | EOL | Interpreters are software in the scheme's definition, so a web server on IaaS running an end-of-life PHP branch is in scope. A one-off fix after end of life, such as the PHP project's source patches for PHP2Shell, is not a commitment to regular fixes. |
Three patterns cover almost every estate. Products past their end date need removing, upgrading or isolating before the assessment. Products with a paid security update program are acceptable for operating systems while the subscription is maintained, and need a conversation with the Certification Body for anything else. And products whose end date falls inside the coming certificate year need a dated plan now, because the board declaration covers the whole year.
Cyber Essentials Plus: what the assessor checks
Cyber Essentials Plus adds a technical audit to the verified self-assessment. The NCSC's test specification (v3.2, still the version IASME links for assessments under v3.3) sets out what the assessor does:
- Before testing: confirm the scope matches the self-assessment certificate, verify it by technical means, verify by technical means that any sub-sets are segregated effectively, and fix the sample of devices to test. The sample has to be representative, and the method behind its size is documented and retained.
- Test case 1, remote vulnerability assessment: an approved scanner is run against every IP address the organisation uses, including IaaS, and each internet-accessible service is judged pass or fail.
- Test case 2, patching: an authenticated vulnerability scan of sampled end-user devices, servers and IaaS instances. Any vulnerability that is vendor-rated critical or high risk, has a CVSS v3 base score of 7 or above, or comes with no severity details, and for which the vendor's fix has been available for more than 14 days, is a fail.
- Any single fail fails the assessment, unless the Delivery Partner accepts it as a small number of minor issues; the specification suggests that exception is meant for marginal deviation in less than 5% of tests, with no sign of a wider failure.
IASME's notice of the 2026 changes adds two rules. An organisation that fails the patching sample has to remediate and is retested on the original sample plus a new random one, so updating only the sampled machines no longer works, and a second failure means the verified self-assessment certificate is revoked. And the self-assessment answers are locked before Cyber Essentials Plus testing begins.
How to build the evidence
Cyber Essentials does not ask for a written end-of-life policy. It asks for facts you can only give if you have an inventory with versions: the make and operating system with edition and feature version of every end-user device (A2.6), every server and hypervisor with its operating system (A2.7), the make and model of every firewall and router (A2.5), and the versions of browsers, malware protection, email and office applications (A6.2.1 to A6.2.4). The NCSC calls asset management a core security function even though it is not a control of its own. Then, for every line, two questions: is it supported today, and does its support end inside the next twelve months?
That second question is where most renewals go wrong, and it is the one lifecycle data answers. endoflife.ai publishes end-of-life dates for 700+ products, and every answer names the source of its date.
1. The API, with a free key
Look up any product and version and get the status, the end-of-life date, days remaining or days past, and the source URL of the date. Get a free API key (emailed, no credit card); the API documentation covers batch lookups for a whole inventory export.
curl -H "X-API-Key: YOUR_KEY" https://api.endoflife.ai/v1/status/windows-server/2016The response includes status, eol_date, days_past_eol, eol_date_source and eol_date_source_url, which is what you need when an assessor asks where a date came from.
2. The scanner and SBOM check
Upload a CycloneDX or SPDX SBOM, or a package manifest, to the scanner for a one-off report of what in it has reached end of life. It is the quickest way to find the interpreters, frameworks and libraries the scheme's definition of software includes. How to audit an SBOM for end-of-life software explains the method, and unsupported software detection covers the wider approach.
3. Your RMM, PSA or monitoring tool
MSPs preparing several clients usually have the inventory already. The HaloPSA integration writes end-of-life dates and their sources onto assets and can open a ticket for each asset past end of life, so every client's remediation has an owner before the questionnaire is due. Zabbix, Splunk, Datadog, Dynatrace, Grafana, a GitHub Action and an MCP server for AI assistants are on the integrations page. For the policy side, the free EOL policy template sets remediation deadlines and an exception process you can adapt to the scheme's stricter rule.
Frequently Asked Questions
Does Cyber Essentials allow unsupported software?
Not on in-scope devices. The NCSC's Requirements for IT Infrastructure v3.3 say all software on in-scope devices must be licensed and supported, and must be removed from devices when it becomes unsupported or removed from scope by using a defined sub-set that prevents all traffic to or from the internet. IASME's question set says an organisation whose in-scope devices run an operating system that is no longer supported, without regular vulnerability fixes from the vendor, will not be awarded certification. There is no compensating-control route.
What does licensed and supported mean in Cyber Essentials?
Software you have a legal right to use, from a vendor that has committed to support it with regular vulnerability fixes and has published the future date when those fixes will stop. The vendor does not have to be the original author of the software, but it must be able to modify the original software to create fixes. The definition is in section B of the NCSC's Requirements for IT Infrastructure v3.3. Options for products past their vendor's date are on the extended support page.
Can I use Windows 10 and still pass Cyber Essentials?
Only while the device is enrolled in Microsoft's Extended Security Updates program. IASME's question set says that for any end-of-life operating system with an extended security update program, you must maintain the required subscription, and that Windows 10 used after its end of support must be signed up to Microsoft's ESU program to remain compliant. Microsoft's ESU requires Windows 10 version 22H2; for organisations it is sold a year at a time, for at most three years. A Windows 10 device without ESU has to be upgraded, replaced, or moved into a sub-set with no internet access.
What is the Cyber Essentials 14-day rule?
All software on in-scope devices must be updated, including vulnerability fixes, within 14 days of release where the update fixes vulnerabilities the vendor describes as critical or high risk, where it addresses vulnerabilities with a CVSS v3 base score of 7 or above, or where the vendor gives no details of the severity of what it fixes. In the IASME question set used for assessments under v3.3, the two questions that ask this, A6.4 for operating systems and firmware and A6.5 for applications, are automatic-fail questions.
Can an unsupported system stay on the network if it is in a sub-set?
A sub-set is part of the organisation whose network is segregated from the rest by a firewall or VLAN. Unsupported software that cannot be removed can be taken out of scope by placing it in a defined sub-set that prevents all traffic to or from the internet. IASME's question set adds that sub-sets made with security groups, microsegmentation or software-based methods are not compliant, and that an out-of-scope sub-set which stays connected to the internet rules out whole-organisation certification. For Cyber Essentials Plus, the assessor verifies the segregation by technical means.
Which version of the Cyber Essentials requirements applies now?
Version 3.3, effective April 27, 2026, according to the NCSC's Cyber Essentials resources page. IASME's self-assessment question set for it is called Danzell. IASME says organisations whose assessment account was created before the cut-over had six months to certify under the previous version.
Sources
Read at the NCSC and IASME for this guide on October 30, 2026:
- NCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026): definitions, scope, Security Update Management.
- NCSC, Cyber Essentials help and resources: the current version and its effective date, and the insurance condition.
- NCSC, Cyber Essentials Plus Test Specification v3.2: scope and sub-set verification, sampling, test cases 1 and 2, pass and fail rules.
- IASME, Preview the self-assessment questions: the Danzell question set (version 16.3), questions A2 and A6.
- IASME, Important Update: Changes to Cyber Essentials for April 2026: automatic-fail questions, point in time, ongoing compliance, Cyber Essentials Plus retests.
- IASME Cyber Essentials Knowledge Hub: Windows 10, Windows 10 reaches end of life and Navigating the pitfalls of legacy software.
Related Resources
- PCI DSS and end-of-life software: what Requirement 12.3.4 asks for
- NIS2 and end-of-life software
- How to Build a Software EOL Management Program That Survives an Audit
- The MSP end-of-life audit
- Windows Server 2012 and 2012 R2: the ESU cliff
- Exchange Server end of life
- Every Windows version and its end-of-support date
- EOL Watch: lifecycle date changes, tracked as they happen