In short
Cyber Essentials requires every in-scope operating system and application to be licensed and supported: the vendor must still provide regular security fixes and have published when they will stop. Unsupported software in scope is an automatic fail, so it must be upgraded, replaced, removed or isolated in a sub-set with no internet access, and be supported on the day your certificate is issued.
Want help with Cyber Essentials supported software review?
We can plan it with you or do it for you. Tell us where you are up to.
What 'supported' means
The NCSC's *Cyber Essentials: Requirements for IT Infrastructure* v3.3 says all in-scope software must be:
- Licensed: you have the legal right to use it.
- Supported: a vendor has committed to providing regular vulnerability fixes and has published the date those fixes will stop. The vendor does not have to be the original author, but must be able to change the software to produce fixes.
"Software" is defined broadly. Operating systems, off-the-shelf applications, browser extensions, interpreters, scripts, libraries, network software and firewall and router firmware all count. Under the Danzell question set, the "point in time" a certificate reflects is the date it is issued, so your software must be supported on that date, and should stay supported for the year the certificate covers.
Why unsupported software is an automatic fail
Software that no longer receives security updates can never be patched, so it can never meet the 14-day rule for critical and high-risk fixes. Unsupported software in scope was an automatic fail before Danzell and remains one: a single unsupported operating system can fail the whole assessment, however good the rest of your answers are.
At Cyber Essentials Plus, test case 2 is an authenticated scan of a sample of devices, which will find unsupported software, and the test specification says virtual patching is not an acceptable long-term answer for legacy, unsupported systems. See Cyber Essentials Plus vulnerability scans.
How to check each platform
| Platform | How to check support | Points to watch |
|---|---|---|
| Windows and Windows Server | Microsoft's lifecycle pages give the end-of-support date for each version and edition | Standard Windows 10 editions left support on 14 October 2025 and now need Extended Security Updates (see Cyber Essentials Windows 10); Windows Server 2016 leaves extended support on 12 January 2027 |
| macOS | Apple does not publish end-of-support dates in advance, so check that your version is still receiving security updates | Keeping Macs on a current release is the safest approach |
| iPhone, iPad and Android | Check that the manufacturer still issues security updates for each model and operating system version in use | An old phone that no longer gets updates fails, whoever owns it |
| Linux | Check the published support lifecycle for the distribution and release you run | Servers kept for one application are easy to overlook |
| Office and server applications | Check the vendor's lifecycle information for each product and version | Office 2016 and 2019, and Exchange Server 2016 and 2019, left support on 14 October 2025 |
| Routers, firewalls and storage | Check that the manufacturer still releases firmware for the model | Firmware counts as software, so equipment that no longer gets updates must be replaced |
We point you to vendors' own lifecycle information rather than listing every version, because support dates move and a list goes out of date quickly. Check each date against the whole period your certificate will cover, not just the day you submit.
Not sure which edition applies to you? Ask us
Tell us about your organisation and we will point you to the right edition.
What to do with unsupported software
| Option | When it suits |
|---|---|
| Upgrade | The device or application can move to a version the vendor still supports |
| Replace | Hardware that cannot run a supported version |
| Extended support | A vendor programme, such as Microsoft's Extended Security Updates, keeps the software supported for a defined period |
| Isolate in a sub-set | Legacy kit that must keep running: the sub-set must block all traffic to and from the internet, and you must justify it to your assessor |
| Remove | Software nobody needs, which also helps with Cyber Essentials secure configuration |
Track end-of-support dates in your asset list so replacements are budgeted before they turn into an automatic fail. Forever Group can help with Microsoft licensing for Windows 11 upgrades and Extended Security Updates; ask us for a quote.
How we help
We inventory every device and application in scope, check each one against its vendor's support status, and plan upgrades, replacements or isolation before you apply, usually as part of a Cyber Essentials gap analysis. Device management with Microsoft Intune then shows which devices are falling behind, so nothing slips out of support during the year. Contact us to check your estate, or return to the Cyber Essentials requirements overview.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Frequently asked questions
What operating systems are supported for Cyber Essentials?
Any operating system that is licensed and whose vendor still provides regular security fixes and has published when they will stop. Check each version against the vendor's lifecycle information. Standard Windows 10 editions only count as supported if enrolled in Extended Security Updates.
Is unsupported software an automatic fail in Cyber Essentials?
Yes. Unsupported software in scope fails the whole assessment. Upgrade, replace or remove it, or isolate it in a sub-set that blocks all traffic to and from the internet.
Which iOS versions are supported for Cyber Essentials?
Any version Apple still provides security updates for on that device. Apple does not publish end-of-support dates in advance, so check that each iPhone and iPad is receiving security updates and that critical and high-risk ones are installed within 14 days.
Does firmware count as software for Cyber Essentials?
Yes. Router and firewall firmware is part of the definition of software, so devices whose manufacturer no longer releases firmware updates must be replaced.
Does software have to stay supported for the whole year?
Under Danzell the certificate reflects the date it is issued, and the director's declaration commits you to staying compliant throughout the certification period. Plan replacements for anything whose support ends during that year.
Still have a question about Cyber Essentials supported software review?
Ask us and a member of our team will reply by email.