End of support (end of life)
End of support is the date after which a vendor stops releasing security fixes for a product, so any new flaws found in it stay open for good. Cyber Essentials requires software to be removed when it becomes unsupported, or moved into a sub-set with no internet access. A6.1, A6.3, A6.6 and A6.7 all check this.
- Term
- End of support
- Also known as
- EOL, End of life, EOS, Unsupported software
- Category
- Devices and software
- Requirement area
- B. Definitions; 3. Security Update Management
- Reviewed against
- Requirements v3.3
What does the term end of support mean in Cyber Essentials?
End of support is the date after which a vendor stops releasing security fixes for a product, so any new flaws found in it stay open for good.
be removed from devices when it becomes unsupported, or removed from scope by using a defined sub-set that prevents all traffic to or from the internet
How does end of support apply to Cyber Essentials?
In plain terms
Think of a car model the manufacturer has stopped making parts for. It still drives, but when something breaks, no fix is coming. Software is the same. After its end-of-support date it still opens and works, but when a new security flaw is found, nobody will close it. Vendors such as Microsoft and Apple publish these dates in advance.
What Cyber Essentials asks
The NCSC definition of licensed and supported software says the vendor "must provide the future date when they will stop providing" vulnerability fixes. Once that date passes, the requirement quoted above applies: remove the software, or put it in a sub-set that blocks all internet traffic.
The A6.1 guidance says "Most major vendors will have published EOL dates for their operating systems and firmware." A6.3 asks whether any in-scope software is unlicensed or unsupported, and A6.6 whether unsupported software has been removed. A6.7 asks how any unsupported software you still need has been moved out of scope. If that sub-set stays connected to the internet, you cannot certify the whole organisation and must choose partial organisation at A2.1. A6.3 and A6.6 are not automatic fails, but the requirement is not met until the software is dealt with.
Common mistakes
- Missing a date that passed between one certificate and the next. Check your list before every assessment.
- Relying on workarounds. The Cyber Essentials Plus test specification says virtual patching is not an acceptable long-term mitigation for legacy unsupported operating systems.
Check dates on the supported software pages or with the is it supported tool. Related: extended security updates, sub-set, licensed and supported software.
Related terms
- Extended Security Updates (ESU)Extended Security Updates are a paid programme in which a vendor keeps sending security fixes for a product after its normal end of support.
- Sub-setA sub-set is part of an organisation whose network is segregated from the rest of the organisation by a firewall or VLAN.
- Licensed and supported softwareLicensed and supported software is software you have a legal right to use and that a vendor supports with regular vulnerability fixes until a published end date.
- End-user device (EUD)An end-user device is any computer, tablet, phone or thin client that a person uses directly to do their work.
- FirmwareFirmware is the software built into a piece of hardware, such as a router or firewall, that makes the hardware work.
- HypervisorA hypervisor is the software that lets one physical computer run several virtual machines at once, sharing out its processor, memory and storage.
Frequently asked questions
End of support is the date after which a vendor stops releasing security fixes for a product, so any new flaws found in it stay open for good. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, end of support comes up at A6.1, A6.2, A6.3, A6.6, A6.7. Read those questions against the definition above so your answers use the term the way the assessor will.
End of support relates to B. Definitions; 3. Security Update Management in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.