A6.2.3: Which email applications do you use, and which versions?
Please list your email applications installed on end user devices and servers. The version is required.
Source: IASME Cyber Essentials Danzell question set v16.3
A6.2.3 needs every email application installed on end user devices and servers, with its version, such as Outlook for Microsoft 365, Apple Mail or an on-premises Exchange Server. Each must still be supported. Exchange 2016 and 2019 are out of support; Exchange Server SE is the supported on-premises version.
Is A6.2.3 an automatic fail?
No. A6.2.3 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- Please list all email applications and versions you use so that the Assessor can understand your setup and verify that they are in support. For example: MS Exchange 2016, Outlook 2019.
- Requirement enforced
You must make sure that all software in scope is kept up to date. All software on in-scope devices must be licensed and supported.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A6.2.2A6.2.4Back to the security update management control
What does A6.2.3 ask?
A6.2.3 asks: “Please list your email applications installed on end user devices and servers. The version is required.”
A6.2.3 asks you to list the email applications installed on end user devices and servers, and says the version is required. The guidance gives the examples 'MS Exchange 2016, Outlook 2019' so the assessor can verify they are in support.
Those examples are dated: Microsoft ended support for Exchange Server 2016, Exchange Server 2019 and Outlook 2019 on 14 October 2025. An on-premises mail server is also an external service under A5.4. See Exchange Server support and Office 2016 and 2019.
What should you write in the notes field for A6.2.3?
Write two to four specific sentences for A6.2.3: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
Windows: Outlook for Microsoft 365 (Microsoft 365 Apps, [Current Channel / Monthly Enterprise Channel], version [version]) and the new Outlook for Windows. macOS: Outlook for Mac version [version]; Apple Mail [version, from macOS version]. iOS and Android: Outlook mobile, kept updated through the app stores. Servers: no on-premises mail server; email is hosted in Exchange Online (A2.9).
Why do applicants fail A6.2.3?
A common reason applicants fail A6.2.3: copying the guidance examples, Exchange 2016 and Outlook 2019, which are now unsupported.
- An on-premises Exchange server kept for a few mailboxes or for SMTP relay.
- Leaving out mobile email apps.
- Giving 'Outlook' with no version or channel.
How do you fix a failing A6.2.3 answer?
If your answer to A6.2.3 would not pass today, fix the control first and then write the answer. In order:
- List every installed email client and on-premises mail server with its version.
- Replace Exchange Server 2016 or 2019 with Exchange Online or Exchange Server SE, and Outlook 2019 or 2016 with a supported version.
How do assessors check A6.2.3?
What evidence should you keep for A6.2.3?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A6.2.3:
- A dated report of email client versions and, if applicable, the mail server version.
Where to go next
- Exchange Server supportSupport dates
- Office 2016 and 2019Support dates
- Is it supported?Check a product's support status
- CE Plus test 2: authenticated patch scanHow the 14-day rule is tested
- Security Update Management requirementsThe control this question tests
- All A6 questionsSecurity update management
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A6 questions
- A6.2.1A6.2.1NotesPlease list your internet browser(s).Notes
- A6.2.2A6.2.2NotesPlease list your malware protection softwareNotes
- A6.2.4A6.2.4NotesPlease list all office applications that are used to create organisational data.Notes
- A6.3A6.3Yes/NoAre any of the in-scope software or cloud services unlicensed or unsupported?Yes/No
Frequently asked questions
A6.2.3 in the 2026 Danzell Cyber Essentials question set asks: "Please list your email applications installed on end user devices and servers. The version is required." It is a notes question, answered in free text.
A6.2.3 needs every email application installed on end user devices and servers, with its version, such as Outlook for Microsoft 365, Apple Mail or an on-premises Exchange Server. Each must still be supported. Exchange 2016 and 2019 are out of support; Exchange Server SE is the supported on-premises version.
No. A6.2.3 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
No. Microsoft ended support for Exchange Server 2016 and 2019 on 14 October 2025. Exchange Server Subscription Edition (SE) is the supported on-premises version; 2016 and 2019 are unsupported software.
Webmail runs in a browser, so the browser in A6.2.1 and the mail service in A2.9 cover it. List any installed email applications here.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh