Vendor
A vendor is the company or organisation that supplies a piece of software or hardware and is responsible for fixing its security flaws. Cyber Essentials relies on vendors throughout: software must have a vendor committed to regular vulnerability fixes with a published end date (A6.1, A6.2), and vendor severity ratings set the 14-day deadline (A6.4, A6.5).
- Term
- Vendor
- Also known as
- Software vendor, Supplier, Manufacturer
- Category
- Devices and software
- Requirement area
- B. Definitions; 3. Security Update Management
- Questions
- A6.1A6.2A6.4AUTO-FAILA6.5AUTO-FAIL
- Reviewed against
- Requirements v3.3
What does the term vendor mean in Cyber Essentials?
A vendor is the company or organisation that supplies a piece of software or hardware and is responsible for fixing its security flaws.
Note that the vendor doesn’t need to have created the software originally, but they must be able to modify the original software to create fixes
How does vendor apply to Cyber Essentials?
In plain terms
The vendor is whoever stands behind a product and sends out the fixes. Microsoft for Windows, Apple for the iPhone and the maker of your office firewall are all vendors. It can also be a company that supports someone else's product, for example a firm that provides paid security fixes for an open-source tool. That is the point of the NCSC note quoted above.
What Cyber Essentials asks
The NCSC definition of licensed and supported software says a vendor "has committed to support by providing regular vulnerability fixes" and "must provide the future date when they will stop providing these". A6.1 and A6.2 ask whether your operating systems and other software meet that test, and the A6.1 guidance says "you should always check with the vendor to confirm if an operating system is still supported".
Vendors also set several other thresholds. The 14-day rule applies to fixes "described by the vendor as ‘critical’ or ‘high risk’", and to any fix where the vendor gives no severity details (A6.4, A6.5). Vulnerability fixes include any mechanism "approved by the vendor". Anti-malware software must be updated "in line with vendor recommendations", and where device unlocking settings cannot be changed, the vendor's default is accepted.
Common mistakes
- Running software with no identifiable vendor, such as an old freeware tool whose author has disappeared. With nobody committed to fixes, it cannot count as supported.
- Guessing support status instead of checking the vendor's published lifecycle page.
Check support status on the supported software pages or with the is it supported tool. Related: licensed and supported software, end of support, open-source software.
Related terms
- Licensed and supported softwareLicensed and supported software is software you have a legal right to use and that a vendor supports with regular vulnerability fixes until a published end date.
- End of support (end of life)End of support is the date after which a vendor stops releasing security fixes for a product, so any new flaws found in it stay open for good.
- Open-source softwareOpen-source software is software whose source code is published for anyone to use, change and share under the terms of its licence, often at no cost.
- Virtual desktop infrastructure (VDI)Virtual desktop infrastructure is a way of running staff desktops on central servers or in the cloud, so the user's own device only displays the desktop.
- Virtual machine (VM)A virtual machine is a complete computer, with its own operating system, that runs as software inside another physical computer.
- Vulnerability fixesVulnerability fixes are patches, updates, registry fixes, configuration changes, scripts or any other mechanism approved by the vendor to fix a known vulnerability.
Frequently asked questions
A vendor is the company or organisation that supplies a piece of software or hardware and is responsible for fixing its security flaws. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, vendor comes up at A6.1, A6.2, A6.4, A6.5. Read those questions against the definition above so your answers use the term the way the assessor will.
Vendor relates to B. Definitions; 3. Security Update Management in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.