A6.2: Is all your software supported by a supplier that issues security fixes?
Is all the software on your devices supported by a supplier that produces regular vulnerability fixes for any security problems?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
Answer Yes to A6.2 only if every piece of software on your in-scope devices, including frameworks, extensions, runtimes and plug-ins, is supported by a supplier that still produces regular security updates and vulnerability fixes. Unsupported software must be removed or moved to a sub-set with no internet access. The version lists in A6.2.1 to A6.2.4 are how the assessor checks.
Is A6.2 an automatic fail?
No. A6.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- All software used by your organisation must be supported by a supplier who provides regular security updates and vulnerability fixes. Unsupported software must be removed from your devices.
- Requirement enforced
You must make sure that all software in scope is kept up to date. All software on in-scope devices must be licensed and supported.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A6.1A6.2.1Back to the security update management control
What does A6.2 ask?
A6.2 asks: “Is all the software on your devices supported by a supplier that produces regular vulnerability fixes for any security problems?”
A6.2 asks whether all the software on your devices is supported by a supplier that produces regular vulnerability fixes for any security problems. The guidance says all software must be supported by a supplier who provides regular security updates and fixes, that unsupported software must be removed from your devices, and that this includes frameworks and extensions.
v3.3 defines software broadly: operating systems, commercial off-the-shelf applications, extensions, interpreters, scripts, libraries, network software and firewall and router firmware. Licensed and supported software has a vendor committed to regular vulnerability fixes with a published end date. The follow-up questions A6.2.1 to A6.2.4 list browsers, malware protection, email and office applications. See licensed and supported software and the supported software guides.
What must be true to answer Yes to A6.2?
You can answer Yes to A6.2 only when all of the following are true today, across every device, user and cloud service in scope.
- Every application installed on in-scope devices has a supplier still issuing security fixes for the installed version.
- Browser extensions, plug-ins and runtimes such as Java and .NET are included in the check.
- Line-of-business applications have a current support agreement or vendor update channel.
- Anything unsupported has been removed (A6.6) or moved to a sub-set with no internet access (A6.7).
Why do applicants fail A6.2?
A common reason applicants fail A6.2: an old perpetual version of Office, such as Office 2016, 2019 or 2021, after its end of support.
- A legacy Java runtime or Adobe product left on a few machines.
- A line-of-business application whose vendor stopped updating it years ago.
- Browser extensions that are no longer maintained.
How do you fix a failing A6.2 answer?
If your answer to A6.2 would not pass today, fix the control first and then write the answer. In order:
- Run a software inventory from your MDM or RMM across every in-scope device.
- Check each product, including extensions, runtimes and plug-ins, against vendor support status.
- Uninstall or upgrade anything unsupported, then update the lists in A6.2.1 to A6.2.4.
How do assessors check A6.2?
What evidence should you keep for A6.2?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A6.2:
- A software inventory from MDM or RMM, checked against vendor support status.
Where to go next
- Is it supported?Check a product's support status
- Licensed and supported softwareGlossary
- Java supportSupport dates
- CE Plus test 2: authenticated patch scanHow the 14-day rule is tested
- Security Update Management requirementsThe control this question tests
- All A6 questionsSecurity update management
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A6 questions
- A6.1A6.1Yes/NoAre all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes?Yes/No
- A6.2.1A6.2.1NotesPlease list your internet browser(s).Notes
- A6.2.2A6.2.2NotesPlease list your malware protection softwareNotes
- A6.2.3A6.2.3NotesPlease list your email applications installed on end user devices and servers.Notes
Frequently asked questions
A6.2 in the 2026 Danzell Cyber Essentials question set asks: "Is all the software on your devices supported by a supplier that produces regular vulnerability fixes for any security problems?" It is a Yes/No question.
Answer Yes to A6.2 only if every piece of software on your in-scope devices, including frameworks, extensions, runtimes and plug-ins, is supported by a supplier that still produces regular security updates and vulnerability fixes. Unsupported software must be removed or moved to a sub-set with no internet access. The version lists in A6.2.1 to A6.2.4 are how the assessor checks.
No. A6.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
No. Microsoft ended support for Office 2016 and Office 2019 on 14 October 2025, and for Office 2021 and Office LTSC 2021 on 13 October 2026. They no longer receive security updates and count as unsupported software. Move to Microsoft 365 Apps on a supported channel or Office LTSC 2024.
Yes. The A6.2 guidance says the requirement includes frameworks and extensions, and v3.3 lists extensions in its definition of software.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh