The supported software rule

Cyber Essentials requires all software on in-scope devices to be licensed and supported. Supported means the vendor is still producing regular security fixes for the version you run. When software stops being supported, you must remove it, or move it into a separate sub-set that has no internet traffic in or out. An unsupported operating system anywhere in scope means you cannot be certified.

What counts as software

The NCSC defines software widely. It includes:

• operating systems, including phone and tablet operating systems
• router and firewall firmware
• off-the-shelf applications, such as office suites, PDF readers and accounting packages
• browser extensions, plug-ins and add-ons
• interpreters, frameworks, scripts and libraries, such as Java or .NET runtimes
• network software, such as VPN clients

What "licensed and supported" means

The requirements define it as software you have a legal right to use, from a vendor that has committed to regular vulnerability fixes and says when those fixes will stop. The vendor does not have to be the original author, but it must be able to change the software to fix it.

In practice:

• Licensed. You hold a valid licence or subscription. Free and open-source software is fine if you follow its licence terms.
• Supported. The vendor still issues security updates for your version. For subscription products, such as some firewalls, updates can stop when the licence lapses, so check renewals.
• Actually updating. The device must be receiving those updates. A supported product on a device that cannot install them does not meet the rule.

Supported is not the same as up to date

These are two separate checks:

1. Is the version line supported? For example, is Windows 11 25H2, macOS 26 or Android 15 still getting security fixes for your device?
2. Is the latest security update installed? Within a supported line, critical and high-risk fixes must be installed within 14 days of release.

An old point release of a supported product is a patching problem, covered by the 14-day update rule. A product line past its end date is a support problem, covered here.

Common examples

IASME's question set gives older systems such as Windows 7, macOS Ventura and Ubuntu 17.10 as examples of unsupported operating systems. Others to watch for:

• Windows 10. Support ended on 14 October 2025. It can only stay in scope with Extended Security Updates. See Windows 10 end of support.
• Windows 11 feature versions. Each version has its own end date, so an un-upgraded laptop can fall out of support.
• Office. Perpetual versions such as Office 2016 and 2019 have reached end of support. Check Microsoft's lifecycle page for the version you run.
• Phones and tablets. Support depends on the model. See mobile devices and support.
• Apple devices. Apple does not publish end dates. See Apple devices and updates.
• Routers and firewalls. Firmware for older models stops being updated. Check the vendor's end-of-life list.

How to check

1. List every operating system, firmware version and application in scope, with versions.
2. Check each against the vendor's lifecycle or end-of-life page. IASME's Knowledge Hub keeps support pages for common operating systems, and endoflife.date gathers many vendors' dates in one place.
3. Note any end dates that fall in the next 12 months, so you can plan before renewal.
4. Remove software nobody uses. Fewer products means fewer to keep supported.

If something is unsupported

You have three routes: upgrade or replace it, pay for an extended support scheme that delivers security fixes, or isolate it in a sub-set separated by a firewall or VLAN with all internet traffic blocked. See options for unsupported software.

Edge cases

• No published end date. Some vendors, notably Apple, do not publish one. IASME's hub states which versions it currently treats as supported.
• Cloud services. The question on unlicensed or unsupported software also covers cloud services. For SaaS, the provider keeps the software updated.
• Bespoke software. If you wrote it, you are the vendor. You need to be able to fix it and keep its components supported.

Whether a particular version is supported on the day you submit is a fact the assessor will check against the vendor, so check it yourself first. The readiness checker asks about unsupported software before you start.