Windows 10 end of support and Extended Security Updates

Microsoft ended support for Windows 10 on 14 October 2025. From that date, a Windows 10 device in scope fails the supported software rule unless it is enrolled in Microsoft's Extended Security Updates (ESU) programme and is receiving those updates. IASME's question set says this directly: if you use Windows 10 after 14 October 2025, you must be signed up to ESU to remain compliant. Apexward, as a Certification Body, also asks you to demonstrate that each device is covered by ESU.

ESU is a short-term bridge. The long-term answer is to upgrade to Windows 11 or replace the device.

What ESU is

ESU is a paid Microsoft programme that keeps delivering critical and important security updates to Windows 10 after support ended. It does not include new features, non-security fixes or general technical support. To be eligible, a device must be running Windows 10 version 22H2. Older Windows 10 versions must first be updated to 22H2.

There are two routes, with different rules.

ESU for organisations

• Bought per device through Microsoft volume licensing, one year at a time.
• Available for up to three years after end of support, which takes it to October 2028.
• Purchases are cumulative: if you join in year two, you also pay for year one.
• The price per device rises each year. Check current pricing with your licensing supplier.
• Included at no extra cost for Windows 10 virtual machines in Windows 365, Azure Virtual Desktop and several other Azure services. Windows 10 devices that connect to Windows 365 Cloud PCs are also entitled to ESU while the subscription is active.

Under this route, a device is only covered for the years you have bought. When the paid period ends, the device becomes unsupported again.

Consumer ESU

• Aimed at individuals and home users on Windows 10 Home, Pro, Pro Education or Pro for Workstations, version 22H2.
• Enrolled through Windows settings with a Microsoft account that has administrator rights. Microsoft offers three ways to enrol: syncing your PC settings, redeeming Microsoft Rewards points, or a one-off payment.
• In June 2026 Microsoft extended consumer ESU by a year, to 12 October 2027. Microsoft has changed this date before, so check Microsoft's consumer ESU page for the current one.
• Not available for devices joined to an Active Directory domain, devices enrolled in mobile device management, or kiosk devices.

Most business devices are domain-joined or managed with MDM, so consumer ESU usually does not apply to them. It may apply to sole traders or to personal devices used for work (BYOD).

What counts for Cyber Essentials

ESU makes a Windows 10 device acceptable only when all of these are true:

1. The device is on Windows 10 version 22H2.
2. It is enrolled in ESU, the cover includes today's date, and you can demonstrate that the device is covered by ESU.
3. It is actually installing the monthly ESU security updates. Check the update history.
4. Each ESU update is installed within 14 days of release, like any other critical or high-risk update. See the 14-day update rule.

Being "eligible" or "planning to buy" ESU is not enough. Apexward asks you to demonstrate that each device is covered by ESU, and an assessor may ask how you know the device is enrolled and updating.

Exceptions

Some Windows 10 editions have their own, longer support dates. Windows 10 Enterprise LTSC and IoT Enterprise LTSC editions follow a separate lifecycle. If you run one, check its end date on Microsoft's lifecycle pages rather than assuming the 14 October 2025 date applies.

Do not forget Windows 11 versions

Each Windows 11 feature version also has an end date. For Home and Pro editions, Microsoft supports a version for 24 months; for Enterprise and Education, 36 months. A Windows 11 laptop that has not taken its annual feature update can drop out of support too.

How to answer

In the scope section, give the edition and version, for example "4 HP desktops, Windows 10 Pro 22H2, enrolled in ESU year 2 via volume licensing". In the update section, answer the supported operating system question with ESU in mind and keep evidence that each device is covered by ESU.

Options if ESU does not suit you

• Upgrade eligible devices to Windows 11.
• Replace devices that cannot run Windows 11.
• Move the device to a sub-set with no internet traffic in or out, which removes it from scope. See options for unsupported software.
• Remove the device from use.

See also the supported software rule. The readiness checker asks about unsupported operating systems before you start.