Open-source software
Open-source software is software whose source code is published for anyone to use, change and share under the terms of its licence, often at no cost. Cyber Essentials accepts it: the A6.3 guidance says free and open-source software is fine if you comply with its licence. It must still be supported with regular fixes and updated within 14 days.
- Term
- Open-source software
- Also known as
- OSS, Free and open-source software, FOSS
- Category
- Devices and software
- Requirement area
- B. Definitions; 3. Security Update Management
- Questions
- A6.2A6.3A6.5AUTO-FAILA6.6
- Reviewed against
- Requirements v3.3
What does the term open-source software mean in Cyber Essentials?
Open-source software is software whose source code is published for anyone to use, change and share under the terms of its licence, often at no cost.
How does open-source software apply to Cyber Essentials?
In plain terms
Open-source software is like a recipe published for anyone to cook, adapt and share, as long as they follow the conditions attached to it. Firefox, LibreOffice, 7-Zip and Linux systems such as Ubuntu are open source. Free to download does not mean free of responsibility: someone still has to keep it up to date.
What Cyber Essentials asks
The A6.3 guidance says: "All software must be licensed. It is acceptable to use free and open-source software as long as you comply with any licensing requirements." That covers the licensed half of licensed and supported.
The supported half is the same as for any other software. The NCSC definition needs a vendor committed to regular vulnerability fixes with a future end date, and adds that "the vendor doesn’t need to have created the software originally, but they must be able to modify the original software to create fixes". An active project team or a company offering support can fill that role. The NCSC definition of software also includes "libraries", so open-source components running on your servers count. Critical and high-risk fixes must go on within 14 days (A6.5).
Common mistakes
- Keeping an old copy of a free tool that was installed once and never updated.
- Using a project its maintainers have abandoned. With no fixes coming, it is unsupported and must be removed (A6.6) or moved into an isolated sub-set (A6.7).
- Forgetting open-source libraries bundled inside other applications on a server.
See the Mozilla Firefox and Ubuntu support pages. Related: licensed and supported software, vendor, software.
Related terms
- Licensed and supported softwareLicensed and supported software is software you have a legal right to use and that a vendor supports with regular vulnerability fixes until a published end date.
- VendorA vendor is the company or organisation that supplies a piece of software or hardware and is responsible for fixing its security flaws.
- SoftwareIn Cyber Essentials, software is any operating system, off-the-shelf application, extension, interpreter, script, library, network software or firewall and router firmware.
- Operating system (OS)An operating system is the core software that runs a device and lets every other program work, such as Windows, macOS, iOS or Android.
- Patch managementPatch management is the routine an organisation follows to find, install and check software updates on every device and service it uses.
- Remote monitoring and management (RMM)Remote monitoring and management is software that lets an IT team or provider check, update and fix an organisation's computers from a distance.
Frequently asked questions
Open-source software is software whose source code is published for anyone to use, change and share under the terms of its licence, often at no cost.
In the 2026 Danzell question set, open-source software comes up at A6.2, A6.3, A6.5, A6.6. Read those questions against the definition above so your answers use the term the way the assessor will.
Open-source software relates to B. Definitions; 3. Security Update Management in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.