In short: Cyber Essentials allows standard Windows 10 editions only on devices still receiving security updates through Microsoft's Extended Security Updates (ESU) programme, which needs version 22H2. Without ESU, such a device in scope is unsupported software and fails the assessment. The alternatives are upgrading to Windows 11, replacing the device, or isolating it with no internet access.
The short answer
Cyber Essentials requires all in-scope software to be licensed and supported, meaning the vendor still provides security fixes. Microsoft stopped providing them for standard Windows 10 editions on 14 October 2025. A Windows 10 device that is not enrolled in Extended Security Updates is therefore unsupported, and unsupported software in scope is an automatic fail under the Danzell question set.
A device enrolled in ESU keeps receiving security updates, so it can stay in scope, provided those updates are installed within the 14-day rule like any other critical or high-risk fix.
Extended Security Updates for organisations
Microsoft's ESU programme for businesses and education works as follows (check Microsoft's ESU page for current terms):
- Devices must be running Windows 10, version 22H2 to receive ESU updates
- Commercial and education ESU is bought by year, for a maximum of three years after end of support; you cannot buy part of a year, and the years are cumulative, so joining in a later year means paying for the earlier years too
- ESU delivers critical and important security updates only: no new features, no non-security fixes and no general technical support
- Windows 10 virtual machines in Windows 365, Azure Virtual Desktop and Azure virtual machines get ESU at no extra cost, and Windows 10 PCs used to connect to Windows 365 Cloud PCs are entitled to ESU for up to three years while the Windows 365 subscription is active
For Cyber Essentials, make sure the ESU licence covers the whole period you will be certified for, since a device that drops out of ESU part-way through becomes unsupported. Keep evidence of enrolment and of devices actually receiving updates. Microsoft sets ESU pricing per year and it rises each year, so ask us for a quote rather than relying on old figures.
Personal Windows 10 PCs and consumer ESU
User-owned computers that access organisational data or services are in scope (see Cyber Essentials, BYOD and home working), so an employee's or volunteer's home Windows 10 PC matters too.
Microsoft runs a separate consumer ESU programme for personal devices. It was first announced as a single year of cover, but Microsoft's consumer ESU page now gives 12 October 2027 as the date the programme and its updates end. A personal Windows 10 PC enrolled in consumer ESU and receiving updates is still supported. One that is not enrolled must be upgraded, replaced, or stopped from reaching work data and services, for example by moving that user to a managed device or a Cloud PC.
Your options for each Windows 10 device
| Option | When it suits | Points to watch |
|---|---|---|
| Upgrade to Windows 11 | Hardware meets Microsoft's Windows 11 requirements | Test business applications first; the cleanest long-term fix |
| Replace the device | Older hardware that cannot run Windows 11 | Budget and lead times; securely wipe the old device |
| Enrol in commercial ESU | Short-term bridge while you upgrade | Version 22H2 only; annual cost rises; three-year ceiling |
| Move users to a Cloud PC | Staff who can work from Windows 365 or Azure Virtual Desktop | Windows 10 endpoints connecting to Windows 365 are entitled to ESU for up to three years while the subscription is active |
| Isolate in a sub-set | Kit that must run legacy software, such as lab or production machines | The sub-set must block all traffic to and from the internet, and you must justify it |
| Retire it | Spare or rarely used machines | Make sure it no longer accesses organisational data or services |
Remember the cost of each option is not just licences: staff time, application testing and data migration all count. Our Cyber Essentials cost guide covers the factors.
Other unsupported software to check
Windows 10 is the biggest item, but not the only one:
- Office 2016 and Office 2019 desktop apps, and Exchange Server 2016 and 2019, reached end of support on the same day as Windows 10, 14 October 2025
- Windows Server 2016 leaves extended support on 12 January 2027; any certificate you hold beyond that date needs those servers upgraded, covered or removed
- Windows 10 Long-Term Servicing Channel editions follow their own lifecycle: Enterprise LTSC 2021 ends on 12 January 2027 and Enterprise LTSC 2019 on 9 January 2029, so check Microsoft's lifecycle page for your exact edition
- macOS: Apple does not publish end-of-support dates in advance, so the practical test is whether your version is still receiving security updates; keeping Macs on a current release is the safest approach
- Phones and tablets: check the manufacturer still issues security updates for each model and operating system version in use
- Routers, firewalls and storage devices: firmware counts as software, so equipment the manufacturer no longer updates must be replaced
How we help
We inventory every device and its support status, separate what can upgrade to Windows 11 from what must be replaced, plan the upgrades through Microsoft Intune, arrange ESU licences as a short-term bridge where it makes sense, and design isolated sub-sets for legacy kit that cannot move yet. We can also supply replacement devices and Windows 11 licensing; ask us for a quote.
Contact us to plan your Windows 10 exit, or see the wider Cyber Essentials requirements and common reasons for failing.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Can I pass Cyber Essentials with Windows 10?
Only if each Windows 10 device in scope is enrolled in Microsoft's Extended Security Updates and is receiving and installing security updates. A Windows 10 device without ESU is unsupported software, which is an automatic fail.
Does Windows 10 ESU count as supported for Cyber Essentials?
Yes. ESU-enrolled devices still receive security fixes from Microsoft, so they can stay in scope. You still need to install critical and high-risk updates within 14 days, and the ESU cover should last for your whole certification period.
What Windows 10 version do I need for ESU?
Microsoft requires Windows 10, version 22H2 for devices to receive Extended Security Updates. Devices on older feature versions must be updated to 22H2 first.
Are employees' home Windows 10 PCs a problem for Cyber Essentials?
They are if they access organisational data or services, because user-owned devices are then in scope. They need to be on supported software, such as Windows 11 or Windows 10 enrolled in Microsoft's consumer ESU, which now runs to 12 October 2027.
What happens to Windows 10 devices in a Cyber Essentials Plus audit?
Sampled devices are checked with an authenticated vulnerability scan. A Windows 10 device without ESU, or with critical or high-risk fixes that have been available for more than 14 days but not installed, will fail the test, and a failed test normally fails the whole assessment.
Are Windows 10 LTSC editions allowed for Cyber Essentials?
Yes, while Microsoft still supports them. Long-Term Servicing Channel editions have their own end dates: Windows 10 Enterprise LTSC 2021 ends on 12 January 2027 and Enterprise LTSC 2019 on 9 January 2029. Plan replacements before the date that falls within your certification period.