Licensed and supported software
Licensed and supported software is software you have a legal right to use and that a vendor supports with regular vulnerability fixes until a published end date. Under Cyber Essentials v3.3 all in-scope software must be licensed and supported or removed from scope. Unlicensed or unsupported software in scope means the requirement behind A6.3 and A6.6 is not met.
- Term
- Licensed and supported software
- Also known as
- Supported software
- Category
- Devices and software
- Requirement area
- B. Definitions; 3. Security Update Management
- Reviewed against
- Requirements v3.3
What does the term licensed and supported software mean in Cyber Essentials?
Licensed and supported software is software you have a legal right to use and that a vendor supports with regular vulnerability fixes until a published end date.
Licensed and supported software is software that you have a legal right to use and that a vendor has committed to support by providing regular vulnerability fixes. The vendor must provide the future date when they will stop providing these. (Note that the vendor doesn’t need to have created the software originally, but they must be able to modify the original software to create fixes).
How does licensed and supported software apply to Cyber Essentials?
In plain terms
Two things must both be true of every piece of software in scope: you are allowed to use it, and someone is still fixing its security flaws. A pirated copy fails the first test. An old version the maker has abandoned fails the second.
What Cyber Essentials asks
Section B defines the term as quoted above. Two tests follow:
- Licensed. The A6.3 guidance says "All software must be licensed. It is acceptable to use free and open-source software as long as you comply with any licensing requirements." It also warns that for some operating systems, firmware and applications, "if annual licensing is not purchased, they will not be receiving regular security updates."
- Supported. The vendor has committed to regular fixes and published the date they stop. The A6.1 guidance says "Most major vendors will have published EOL dates for their operating systems and firmware", and that for any end-of-life operating system with an extended security update programme, "you must maintain the required subscription."
The security update management requirement says all software on in-scope devices must "be licensed and supported" and "be removed from devices when it becomes unsupported, or removed from scope by using a defined sub-set that prevents all traffic to or from the internet."
Which questions check it?
| Question | Asks | Compliant answer |
|---|---|---|
| A6.1 | Are all operating systems, including router and firewall firmware, supported? | Yes |
| A6.2 | Is all other software supported, including frameworks and extensions? | Yes |
| A6.3 | Is any in-scope software or cloud service unlicensed or unsupported? | No (if Yes, list it at A6.3.1) |
| A6.6 | Have you removed unsupported software? | Yes |
| A6.7 | How is any unsupported software you need kept out of scope? | A sub-set with no internet access, described in notes |
A6.3 and A6.6 are not labelled automatic fails, but IASME's FAQ says any company using unsupported software in the scope of the assessment will fail to achieve certification.
Worked example
A finance PC still runs an old accounts package whose vendor stopped issuing fixes. Options: upgrade it, remove it, or move that PC onto a separate network segment with all internet traffic blocked and describe this at A6.7. If the sub-set stays connected to the internet, A6.7 says you must select partial organisation at A2.1.
Check dates on the supported software pages and read the security update management requirements. Related: end of support, extended security updates, sub-set.
Related terms
- End of support (end of life)End of support is the date after which a vendor stops releasing security fixes for a product, so any new flaws found in it stay open for good.
- Extended Security Updates (ESU)Extended Security Updates are a paid programme in which a vendor keeps sending security fixes for a product after its normal end of support.
- Sub-setA sub-set is part of an organisation whose network is segregated from the rest of the organisation by a firewall or VLAN.
- Long-term support (LTS)Long-term support is a version of a product that the vendor commits to keep fixing for several years, rather than the shorter period a normal release gets.
- MacrosA macro is a small program saved inside a document or spreadsheet that automates tasks, and it can run as soon as the file is opened.
- Mobile device management (MDM)Mobile device management is software that lets an organisation set up, secure and track its phones, tablets and laptops remotely from one console.
Frequently asked questions
Licensed and supported software is software you have a legal right to use and that a vendor supports with regular vulnerability fixes until a published end date. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, licensed and supported software comes up at A6.1, A6.2, A6.3, A6.3.1, A6.6, A6.7. Read those questions against the definition above so your answers use the term the way the assessor will.
Licensed and supported software relates to B. Definitions; 3. Security Update Management in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.