A6.1: Are all your operating systems, including firewall firmware, still supported?
Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes? If you have included firewall or router devices in your scope, the firmware of these devices is considered to be an operating system and needs to meet this requirement.
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
To answer Yes to A6.1 every operating system in scope, including the firmware on firewalls and routers, must be supported by a vendor that still produces regular security updates and vulnerability fixes. Windows 10 after 14 October 2025 counts only with Extended Security Updates. Check each version in A2.5 to A2.8 against the vendor's published end-of-life date.
Is A6.1 an automatic fail?
No. A6.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- 10. This is not an exhaustive list and you should always check with the vendor to confirm if an operating system is still supported It is important you keep track of your operating systems and understand when they have gone end of life (EOL).
- Requirement enforced
You must make sure that all software in scope is kept up to date. All software on in-scope devices must be licensed and supported.
Vulnerability fixes include patches, updates, registry fixes, configuration changes, scripts or any other mechanism approved by the vendor to fix a known vulnerability.
Extended Security Update schemes
For any end-of-life operating system that has an extended security update program, you must maintain the required subscription.
If you are using Windows 10 beyond the 14th October 2025 you must be signed up to the Microsoft Extended Security Update program in order to remain compliant.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A5.10A6.2Back to the security update management control
What does A6.1 ask?
A6.1 asks: “Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes? If you have included firewall or router devices in your scope, the firmware of these devices is considered to be an operating system and needs to meet this requirement.”
A6.1 asks whether all operating systems on your devices are supported by a vendor that produces regular security updates and vulnerability fixes, and states that firewall and router firmware is considered an operating system for this purpose.
Licensed and supported software is software that you have a legal right to use and that a vendor has committed to support by providing regular vulnerability fixes, with a published date for when that support ends. The guidance gives examples of operating systems that are out of support: Windows XP, Vista, Server 2003, Windows 10, macOS Ventura, iOS 15, Android 12 and Ubuntu 17.10, and stresses that this is not an exhaustive list.
The guidance also covers extended security update schemes: for any end-of-life operating system with such a programme you must maintain the required subscription, and if you are using Windows 10 beyond 14 October 2025 you must be signed up to the Microsoft Extended Security Update programme to remain compliant. Check versions with the is it supported tool and the Windows 10, Windows 11, macOS, iOS and Android pages.
What must be true to answer Yes to A6.1?
You can answer Yes to A6.1 only when all of the following are true today, across every device, user and cloud service in scope.
- Every operating system version listed in A2.6, A2.6.1, A2.7 and A2.8 has a vendor end-of-support date in the future, or an active extended security update subscription.
- Every firewall and router in A2.5 runs firmware the vendor still supports with security fixes.
- Virtual desktop and hypervisor hosts are included, not just the guest operating systems.
- You have a record of each end-of-life date so you can act before it passes.
Why do applicants fail A6.1?
A common reason applicants fail A6.1: windows 10 devices still in use after 14 October 2025 without Extended Security Updates.
- An old firewall or router whose vendor stopped issuing firmware, often the ISP-supplied device.
- macOS more than two major versions behind, or Android phones on a version the manufacturer no longer patches.
- A version-less inventory ('Windows 11', 'iOS') that cannot be checked, which leads the assessor to ask and delays the mark.
How do you fix a failing A6.1 answer?
If your answer to A6.1 would not pass today, fix the control first and then write the answer. In order:
- Export operating system versions for every device in A2.6 to A2.8 and firmware versions for every device in A2.5.
- Check each against the vendor's end-of-support date.
- Upgrade, replace or remove anything unsupported; for Windows 10, enrol in Extended Security Updates or upgrade to Windows 11.
- If a device must stay, isolate it on a sub-set with no internet access (A6.7).
How do assessors check A6.1?
What evidence should you keep for A6.1?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A6.1:
- The device inventory with operating system versions against each vendor's end-of-support date.
- Firewall firmware versions and the vendor support status.
Where to go next
- Is it supported?Check a product's support status
- Windows 10 and Cyber EssentialsExtended Security Updates
- macOS supportSupport dates
- End of supportGlossary
- CE Plus test 2: authenticated patch scanHow the 14-day rule is tested
- Security Update Management requirementsThe control this question tests
- All A6 questionsSecurity update management
- Cyber Essentials checklistThe evidence to gather for every question
Other A6 questions
- A6.2A6.2Yes/NoIs all the software on your devices supported by a supplier that produces regular vulnerability fixes for any security problems?Yes/No
- A6.2.1A6.2.1NotesPlease list your internet browser(s).Notes
- A6.2.2A6.2.2NotesPlease list your malware protection softwareNotes
- A6.2.3A6.2.3NotesPlease list your email applications installed on end user devices and servers.Notes
Frequently asked questions
A6.1 in the 2026 Danzell Cyber Essentials question set asks: "Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes? If you have included firewall or router devices in your scope, the firmware of these devices is considered to be an operating system and needs to meet this requirement." It is a Yes/No question.
To answer Yes to A6.1 every operating system in scope, including the firmware on firewalls and routers, must be supported by a vendor that still produces regular security updates and vulnerability fixes. Windows 10 after 14 October 2025 counts only with Extended Security Updates. Check each version in A2.5 to A2.8 against the vendor's published end-of-life date.
No. A6.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Only with the Microsoft Extended Security Update programme. The A6.1 guidance is explicit: if you are using Windows 10 beyond 14 October 2025 you must be signed up to ESU to remain compliant. Without it, Windows 10 is unsupported software in scope. Keep the enrolment current: Microsoft sells commercial ESU a year at a time for up to three years after end of support, and its consumer ESU programme runs until 12 October 2027, so a Windows 10 device whose ESU cover has lapsed is unsupported.
Yes. A6.1 states that if firewall or router devices are in scope, their firmware is considered to be an operating system and needs to meet this requirement. It also falls under the 14-day rule in A6.4.
Apple does not publish formal end-of-life dates. In practice it issues security updates for the current major version and the two before it, so the current and two previous majors are treated as supported. The A6.1 guidance names macOS Ventura as an example of an unsupported version.
Each release has a published support end date, for example Ubuntu LTS releases get five years of standard support. The guidance names Ubuntu 17.10 as an example of an unsupported release. Interim releases and unpatched appliances are the usual problem.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh