Operating system (OS)
An operating system is the core software that runs a device and lets every other program work, such as Windows, macOS, iOS or Android. Cyber Essentials requires every operating system in scope to be supported by its vendor (A6.1) and to get critical and high-risk updates within 14 days (A6.4, an automatic fail if answered No).
- Term
- Operating system
- Also known as
- OS
- Category
- Devices and software
- Requirement area
- B. Definitions; 3. Security Update Management
- Reviewed against
- Requirements v3.3
What does the term operating system mean in Cyber Essentials?
An operating system is the core software that runs a device and lets every other program work, such as Windows, macOS, iOS or Android.
How does operating system apply to Cyber Essentials?
In plain terms
Think of the operating system as the building a business trades from, and programs such as Outlook or Chrome as the tenants. If the building's locks are broken, it does not matter how careful each tenant is. Windows 11 on a laptop, macOS on a MacBook, iOS on an iPhone, Android on a tablet and Windows Server or Ubuntu on a server are all operating systems.
What Cyber Essentials asks
The NCSC definition of software starts with "operating systems", so every software rule applies. A2.6, A2.7 and A2.8 ask you to list the operating system and version on each type of device. A6.1 asks whether every operating system is "supported by a vendor that produces regular security updates and vulnerability fixes", and the question adds that firewall and router firmware counts as an operating system. A6.4 asks whether critical and high-risk updates for operating systems and firmware are installed within 14 days, and is an automatic fail on a No. A6.4.1 asks whether automatic updates are turned on.
Common mistakes
- Writing "Windows 11" with no detail. The A2.6 guidance says the edition and feature version are required.
- Keeping one old machine on an unsupported version. The A6.1 guidance gives examples of older operating systems out of regular support, including Windows 10, macOS Ventura, iOS 15 and Android 12, and says Windows 10 beyond 14 October 2025 needs Microsoft's Extended Security Update programme.
Check a version with the is it supported tool or the supported software pages, and see the Windows 11 setup guide. Related: firmware, end of support, security update.
Related terms
- FirmwareFirmware is the software built into a piece of hardware, such as a router or firewall, that makes the hardware work.
- End of support (end of life)End of support is the date after which a vendor stops releasing security fixes for a product, so any new flaws found in it stay open for good.
- Security update (security patch)A security update is a fix released by a software maker to close a known weakness that attackers could use to break in.
- Patch managementPatch management is the routine an organisation follows to find, install and check software updates on every device and service it uses.
- Remote monitoring and management (RMM)Remote monitoring and management is software that lets an IT team or provider check, update and fix an organisation's computers from a distance.
- Secure configurationSecure configuration means changing the factory settings on computers, phones, servers and cloud services so they only do what the business needs and have no easy ways in.
Frequently asked questions
An operating system is the core software that runs a device and lets every other program work, such as Windows, macOS, iOS or Android.
In the 2026 Danzell question set, operating system comes up at A2.6, A2.7, A2.8, A6.1, A6.4, A6.4.1. Read those questions against the definition above so your answers use the term the way the assessor will.
Operating system relates to B. Definitions; 3. Security Update Management in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.