Unnecessary software
Unnecessary software is any program, built-in tool or background service on a device or cloud account that the business does not use. Cyber Essentials requires you to regularly remove or disable it, because every extra program is another thing to patch and another way in. A5.1 asks how you do this.
- Term
- Unnecessary software
- Also known as
- Bloatware, Unused software
- Category
- Devices and software
- Requirement area
- 2. Secure Configuration
- Questions
- A5.1
- Reviewed against
- Requirements v3.3
What does the term unnecessary software mean in Cyber Essentials?
Unnecessary software is any program, built-in tool or background service on a device or cloud account that the business does not use.
remove or disable unnecessary software (including applications, system utilities and network services)
How does unnecessary software apply to Cyber Essentials?
In plain terms
Every door in a building needs a lock and someone to check it. Brick up the doors you never use and there is less to check and fewer ways in. Software works the same way. The trial antivirus that came with a new laptop, a game, a PDF editor installed once for one job or an old remote access tool all need updates, and each one could hold a flaw.
What Cyber Essentials asks
The NCSC lists "pre-installed but unnecessary applications or services" among the weak points of an out-of-the-box device, and the secure configuration requirement quoted above says to remove or disable them regularly.
A5.1 is a notes question covering "laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services". The IASME guidance says "You must remove or disable applications, system utilities and network services that are not needed in day-to-day use" and adds that you "need to check your cloud services and disable any services that are not required for day-to-day use." It also explains where to find the list of installed applications on Windows, macOS and Linux.
What an assessor looks for
- A clear process in A5.1, such as a standard build and a periodic review, rather than a bare "Yes".
- Cloud services as well as devices. Unused features in Microsoft 365 or Google Workspace count.
- Fewer knock-on problems. Less software means fewer updates to chase under A6.5 and less unsupported software to find at A6.6.
See the secure configuration requirements and question A5.1. Related: secure configuration, browser extension, software.
Related terms
- Secure configurationSecure configuration means changing the factory settings on computers, phones, servers and cloud services so they only do what the business needs and have no easy ways in.
- Browser extensionA browser extension is a small add-on program that adds a feature to a web browser, such as a password manager, ad blocker or PDF tool.
- SoftwareIn Cyber Essentials, software is any operating system, off-the-shelf application, extension, interpreter, script, library, network software or firewall and router firmware.
- VendorA vendor is the company or organisation that supplies a piece of software or hardware and is responsible for fixing its security flaws.
- Virtual desktop infrastructure (VDI)Virtual desktop infrastructure is a way of running staff desktops on central servers or in the cloud, so the user's own device only displays the desktop.
- Virtual machine (VM)A virtual machine is a complete computer, with its own operating system, that runs as software inside another physical computer.
Frequently asked questions
Unnecessary software is any program, built-in tool or background service on a device or cloud account that the business does not use. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, unnecessary software comes up at A5.1. Read those questions against the definition above so your answers use the term the way the assessor will.
Unnecessary software relates to 2. Secure Configuration in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.