Software
In Cyber Essentials, software is any operating system, off-the-shelf application, extension, interpreter, script, library, network software or firewall and router firmware. All of it must be licensed, supported and updated within 14 days when a fix is critical or high risk. A6.2.1 to A6.2.4 ask for your browsers, anti-malware, email clients and office applications with versions.
- Term
- Software
- Category
- Devices and software
- Requirement area
- B. Definitions; 3. Security Update Management
- Questions
- A6.2A6.3A6.5AUTO-FAILA6.6
- Reviewed against
- Requirements v3.3
What does the term software mean in Cyber Essentials?
In Cyber Essentials, software is any operating system, off-the-shelf application, extension, interpreter, script, library, network software or firewall and router firmware.
Software includes operating systems, commercial off-the-shelf applications, extensions, interpreters, scripts, libraries, network software and firewall and router firmware.
How does software apply to Cyber Essentials?
In plain terms
If it runs on a device, it is software for Cyber Essentials purposes. That includes the obvious programs with icons, and the less obvious layers underneath: the Chrome extension a member of staff added, the Java runtime an old finance tool needs, the PowerShell script that maps drives, and the firmware inside the office firewall.
What does the definition cover?
Section B defines the term as quoted above. The breadth is deliberate. When the security update management requirement says "all software on in-scope devices must be licensed and supported" and updated within 14 days for critical or high-risk fixes, it applies to every layer:
| Type in the definition | Everyday examples |
|---|---|
| Operating systems | Windows 11, macOS, iOS, Android, Windows Server, Ubuntu |
| Commercial off-the-shelf applications | Microsoft 365 apps, Adobe Acrobat Reader, Zoom, Sage |
| Extensions | Browser extensions and add-ins for Outlook or Excel |
| Interpreters, scripts and libraries | Java and .NET runtimes, Python, PowerShell modules, open-source libraries on a web server |
| Network software | VPN clients, remote support agents |
| Firewall and router firmware | The software inside your boundary firewall or broadband router |
Which questions ask about software?
The question set samples the definition rather than listing everything. A6.2.1 to A6.2.4 ask for browsers, anti-malware, email clients and office applications with versions. A6.3 asks whether all software is licensed and supported, and the guidance accepts free and open-source software "as long as you comply with any licensing requirements". A6.5 asks about updates for "software (including any associated files and extensions)", and A6.6 asks whether unsupported software has been removed.
Bespoke code you write yourself is out of scope under section D(vii), but the platform it runs on is not.
Common mistakes
- An unsupported runtime, such as an old Java version, left behind by an application that was uninstalled years ago.
- Browser extensions nobody approved. They are software and need to be supported and kept up to date.
- Listing versions at A6.2 from memory rather than checking the devices.
See the security update management requirements, software development scope and the is it supported tool. Related: licensed and supported software, unnecessary software, browser extension.
Related terms
- Licensed and supported softwareLicensed and supported software is software you have a legal right to use and that a vendor supports with regular vulnerability fixes until a published end date.
- Unnecessary softwareUnnecessary software is any program, built-in tool or background service on a device or cloud account that the business does not use.
- Browser extensionA browser extension is a small add-on program that adds a feature to a web browser, such as a password manager, ad blocker or PDF tool.
- Thin clientA thin client is a simple, low-powered computer that mainly acts as a screen and keyboard for a virtual desktop running somewhere else.
- VendorA vendor is the company or organisation that supplies a piece of software or hardware and is responsible for fixing its security flaws.
- Virtual desktop infrastructure (VDI)Virtual desktop infrastructure is a way of running staff desktops on central servers or in the cloud, so the user's own device only displays the desktop.
Frequently asked questions
In Cyber Essentials, software is any operating system, off-the-shelf application, extension, interpreter, script, library, network software or firewall and router firmware. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, software comes up at A6.2, A6.3, A6.5, A6.6. Read those questions against the definition above so your answers use the term the way the assessor will.
Software relates to B. Definitions; 3. Security Update Management in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.