A6.2.4: Which office applications do you use, and which versions?
Please list all office applications that are used to create organisational data. The version is required.
Source: IASME Cyber Essentials Danzell question set v16.3
A6.2.4 needs every office application used to create organisational data, with its version, so the assessor can confirm each is supported. Typical answers are Microsoft 365 Apps with the update channel, Google Workspace, LibreOffice or Apple iWork. Office 2016 and 2019 lost support in October 2025, and Office 2021 on 13 October 2026.
Is A6.2.4 an automatic fail?
No. A6.2.4 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- Please list all office applications and versions you use so that the Assessor can understand your setup and verify that they are in support. For example: MS 365, Libre Office, Google Workspace, Office 2016.
- Requirement enforced
You must make sure that all software in scope is kept up to date. All software on in-scope devices must be licensed and supported.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A6.2.3A6.3Back to the security update management control
What does A6.2.4 ask?
A6.2.4 asks: “Please list all office applications that are used to create organisational data. The version is required.”
A6.2.4 asks you to list all office applications used to create organisational data, and says the version is required. The guidance gives the examples 'MS 365, Libre Office, Google Workspace, Office 2016' so the assessor can verify they are in support.
Office 2016 in that example is now out of support: Microsoft ended support for Office 2016 and Office 2019 on 14 October 2025, and for Office 2021 and Office LTSC 2021 on 13 October 2026. Microsoft 365 Apps are supported while you stay on a supported update channel, and Office LTSC 2024 is the supported perpetual version. See Office 2016 and 2019.
What should you write in the notes field for A6.2.4?
Write two to four specific sentences for A6.2.4: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
Microsoft 365 Apps for business, [Current Channel / Monthly Enterprise Channel], version [version], on Windows and macOS, updated automatically through [Intune / Microsoft 365 admin centre]. Google Workspace (browser-based). [LibreOffice version on n devices.] Adobe Acrobat Reader [version] for PDFs. No other office applications are used.
Why do applicants fail A6.2.4?
A common reason applicants fail A6.2.4: office 2016, 2019 or 2021 still installed on a few machines.
- A perpetual licence Office version used by one team.
- A PDF editor or other document tool left off the list.
- Giving 'Microsoft Office' with no version or channel.
How do you fix a failing A6.2.4 answer?
If your answer to A6.2.4 would not pass today, fix the control first and then write the answer. In order:
- List every office application with its version or update channel.
- Uninstall Office 2016, 2019 and 2021 and move users to Microsoft 365 Apps on a supported channel or Office LTSC 2024.
- Include PDF editors and other document tools.
How do assessors check A6.2.4?
What evidence should you keep for A6.2.4?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A6.2.4:
- A dated report of office application versions and update channels.
Where to go next
- Office 2016 and 2019Support dates
- Adobe Acrobat ReaderSupport dates
- Is it supported?Check a product's support status
- CE Plus test 2: authenticated patch scanHow the 14-day rule is tested
- Security Update Management requirementsThe control this question tests
- All A6 questionsSecurity update management
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A6 questions
- A6.2.2A6.2.2NotesPlease list your malware protection softwareNotes
- A6.2.3A6.2.3NotesPlease list your email applications installed on end user devices and servers.Notes
- A6.3A6.3Yes/NoAre any of the in-scope software or cloud services unlicensed or unsupported?Yes/No
- A6.3.1A6.3.1NotesIf yes to A6.3, please list the unsupported or unlicensed software or cloud services.Notes
Frequently asked questions
A6.2.4 in the 2026 Danzell Cyber Essentials question set asks: "Please list all office applications that are used to create organisational data. The version is required." It is a notes question, answered in free text.
A6.2.4 needs every office application used to create organisational data, with its version, so the assessor can confirm each is supported. Typical answers are Microsoft 365 Apps with the update channel, Google Workspace, LibreOffice or Apple iWork. Office 2016 and 2019 lost support in October 2025, and Office 2021 on 13 October 2026.
No. A6.2.4 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
No. Microsoft ended support for Office 2019 on 14 October 2025 and for Office 2021 on 13 October 2026, so neither receives security updates and both count as unsupported software.
While it is on a supported update channel and version. Keep it updating automatically and give the channel and version in your answer.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh