Extended Security Updates (ESU)
Extended Security Updates are a paid programme in which a vendor keeps sending security fixes for a product after its normal end of support. The IASME guidance at A2.6 and A6.1 says you must keep the subscription for any end-of-life operating system you rely on, and that Windows 10 after 14 October 2025 needs Microsoft ESU.
- Term
- Extended Security Updates
- Also known as
- ESU, Extended support
- Category
- Devices and software
- Requirement area
- 3. Security Update Management
- Reviewed against
- Requirements v3.3
What does the term Extended Security Updates mean in Cyber Essentials?
Extended Security Updates are a paid programme in which a vendor keeps sending security fixes for a product after its normal end of support.
How does Extended Security Updates apply to Cyber Essentials?
In plain terms
It works like an extended warranty on a car you have decided to keep past the standard warranty. You pay, and repairs keep coming for a fixed term. When that term ends, you are on your own. ESU gives you time to plan an upgrade, but it is not a way to keep old systems forever.
What Cyber Essentials asks
The A2.6 and A6.1 guidance both say: "For any end-of-life operating system that has an extended security update program, you must maintain the required subscription. If you are using Windows 10 beyond the 14th October 2025 you must be signed up to the Microsoft Extended Security Update program in order to remain compliant."
This fits the NCSC definition of licensed and supported software, where a vendor has committed to regular vulnerability fixes and given a future end date. A paid ESU subscription meets that test for as long as it runs. Microsoft's ESU documentation adds the practical limits: support for Windows 10 ended on 14 October 2025, ESU is bought one year at a time, devices must run Windows 10 version 22H2, and organisations can receive updates for a maximum of three years after end of support. ESU delivers security updates only, with no new features.
Common mistakes
- Buying ESU but not enrolling every device. Keep proof that each Windows 10 machine listed at A2.6 is covered.
- Forgetting the 14-day rule. ESU updates still have to be installed within 14 days where they fix critical or high-risk issues (A6.4).
- Letting the subscription lapse. When ESU ends, the device is unsupported and must be upgraded, removed or moved out of scope.
See the Windows 10 support page and the security update management requirements. Related: end of support, long-term support, licensed and supported software.
Related terms
- End of support (end of life)End of support is the date after which a vendor stops releasing security fixes for a product, so any new flaws found in it stay open for good.
- Long-term support (LTS)Long-term support is a version of a product that the vendor commits to keep fixing for several years, rather than the shorter period a normal release gets.
- Licensed and supported softwareLicensed and supported software is software you have a legal right to use and that a vendor supports with regular vulnerability fixes until a published end date.
- FirmwareFirmware is the software built into a piece of hardware, such as a router or firewall, that makes the hardware work.
- HypervisorA hypervisor is the software that lets one physical computer run several virtual machines at once, sharing out its processor, memory and storage.
- Jailbreaking and rootingJailbreaking (on iPhones and iPads) and rooting (on Android) mean removing the maker's built-in restrictions so the owner can install anything and change system files.
Frequently asked questions
Extended Security Updates are a paid programme in which a vendor keeps sending security fixes for a product after its normal end of support.
In the 2026 Danzell question set, Extended Security Updates comes up at A2.6, A6.1. Read those questions against the definition above so your answers use the term the way the assessor will.
Extended Security Updates relates to 3. Security Update Management in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.