Options for unsupported software

Unsupported software cannot stay on in-scope devices. You have four options: upgrade or replace it, pay for an extended support scheme that keeps delivering security fixes, uninstall it, or move it into a sub-set separated by a firewall or VLAN that blocks all traffic to and from the internet. Leaving it in place and answering "Yes" is not an option, because an unsupported operating system or application in scope means you cannot be certified.

Option 1: upgrade or replace

This is the only lasting fix.

• Operating systems. Move to a supported version, for example Windows 10 to Windows 11, or an older macOS to one Apple still patches.
• Applications. Upgrade to a supported release, or move to the vendor's subscription version.
• Hardware that cannot upgrade. Replace the device. This includes routers and firewalls whose firmware is no longer updated, and phones whose manufacturer has stopped security updates.
• Line-of-business software. Ask the supplier for a supported version or a replacement product. If the supplier has gone, look for an alternative.

Start well before your renewal. Look up end dates for everything in scope at least 12 months ahead.

Option 2: extended support that delivers fixes

Some vendors sell extra years of security updates after normal support ends. Examples include Microsoft's Extended Security Updates for Windows 10 and Ubuntu Pro's Expanded Security Maintenance. Paid extended support counts as supported only when:

• you hold the subscription for the current period and can show the device is covered
• the device is actually receiving the updates
• the updates are installed within 14 days of release

The NCSC definition of supported software allows a vendor other than the original author, provided it can modify the software to fix it. Whether a particular third-party support scheme meets that test is the assessor's judgement, so ask your Certification Body before relying on one. For Windows 10, see Windows 10 end of support.

Option 3: uninstall it

Often the simplest answer. Old browsers, PDF readers, Java runtimes, plug-ins and tools nobody uses should go. Removing unneeded software is a secure configuration requirement anyway.

Option 4: isolate it in a sub-set

If you have a genuine business need, such as a machine controller, lab instrument or legacy database, you can take it out of scope by placing it in a sub-set:

• The sub-set must be separated from the rest of your network by a firewall or VLAN. Software firewalls on the device, security groups, micro-segmentation and user groups do not count.
• All traffic between the sub-set and the internet must be blocked, inbound and outbound. That means no email, web browsing, cloud sync or remote support tools from those devices.
• Describe the excluded network and how it is separated in the scope questions (A2.2.1 and A2.2.2), list the equipment that creates the sub-set (A2.5.1), and explain the arrangement in A6.7.

If the isolated sub-set has no internet access at all, you can still certify the whole organisation. If it can still reach the internet, you must choose partial organisation scope, and the unsupported software still has to be removed from everything that stays in scope.

Plan how data moves in and out of the sub-set without breaking the rule, for example by exporting files through an internal transfer that does not route to the internet. Be careful with removable media, which can carry malware either way.

What does not work

• Keeping the software but "not using it".
• Running it in a virtual machine that can still reach the internet. Virtual machines are devices in their own right.
• Relying on antivirus or a firewall to make up for missing patches.

How to answer

• A6.3 asks whether any in-scope software or cloud service is unlicensed or unsupported. The compliant answer is No.
• A6.6 asks whether you have removed unsupported software.
• A6.7 asks how you have moved any unsupported software out of scope. If you have none, say so.

Your Certification Body decides whether your isolation is adequate, and may ask how traffic is blocked.

Read more in the supported software rule and whole organisation or a sub-set.