Check your readiness
Question A6.3 · Security update management

A6.3: Is any in-scope software or cloud service unlicensed or unsupported?

Yes/No
Updated 3 November 2026
A6.3The question, word for word
Are any of the in-scope software or cloud services unlicensed or unsupported?

Compliant answerNo

Source: IASME Cyber Essentials Danzell question set v16.3

Short answer

A compliant answer to A6.3 is No: every piece of software and every cloud service in scope must be licensed and still receive vendor security updates. A Yes means the requirement is not met, and the application will not pass until the software is removed or moved out of scope. Open-source software is acceptable within its licence terms.

Is A6.3 an automatic fail?

No. IASME's guidance does not label A6.3 an automatic fail. But a Yes means the requirement that all software on in-scope devices must be licensed and supported is not met, and the assessor will not pass the application until the software is removed or moved into a sub-set with no internet access (A6.7).

Key facts
Compliant answer
No
Answer type
Yes/No a Yes/No question
IASME guidance
All software must be licensed. It is acceptable to use free and open-source software as long as you comply with any licensing requirements.
Requirement enforced

All software on in-scope devices must be licensed and supported.

Outcome if non-compliant
A fail: IASME's FAQ says any company using unsupported software in scope will fail, so remove, upgrade or move the software out of scope first

What does A6.3 ask?

A6.3 asks: “Are any of the in-scope software or cloud services unlicensed or unsupported?”

A6.3 asks whether any of the in-scope software or cloud services are unlicensed or unsupported. It is phrased the opposite way round to most questions in the set: No is the compliant answer. The A6.3 guidance carries no automatic-fail wording, but IASME's FAQ says "any company using unsupported software in the scope of the assessment will fail to achieve Cyber Essentials certification", so a Yes is a fail.

IASME's guidance: all software must be licensed, and free and open-source software is acceptable as long as you comply with any licensing requirements. For some operating systems, firmware and applications, if annual licensing is not purchased, they will not receive regular security updates.

The requirement behind it, from v3.3: all software on in-scope devices must be licensed and supported. Licensed and supported software is software you have a legal right to use and that a vendor has committed to support with regular vulnerability fixes, with a published date when that support ends.

If you answer Yes, A6.3.1 asks you to list the unsupported or unlicensed software or cloud services.

What must be true to answer No to A6.3?

You can answer No to A6.3 only when all of the following are true today, across every device, user and cloud service in scope.

  • Every operating system in the A2 device lists is within its vendor's security support period, and Windows 10 devices used after 14 October 2025 are enrolled in Microsoft's Extended Security Update programme.
  • Every browser, anti-malware product, email client and office application in A6.2.1 to A6.2.4 is a version the vendor still patches.
  • Every cloud service in A2.9 is on a licensed plan the provider still supports.
  • Firewall and router firmware is still receiving vendor security updates.
  • Any unsupported software you must keep has been removed from scope in a sub-set with no internet access, described at A6.7.

Why do applicants fail A6.3?

A common reason applicants fail A6.3: a Windows 10 device still in use after 14 October 2025 without Extended Security Updates.

Other reasons it fails
  • An old browser or PDF reader left on a few laptops after the fleet was upgraded.
  • Answering No while the software lists at A6.2.1 to A6.2.4 name a version that is out of support, which the assessor will spot.
  • Firmware on an ISP-supplied router or an old firewall that the vendor no longer updates.

How do you fix a failing A6.3 answer?

If your answer to A6.3 would not pass today, fix the control first and then write the answer. In order:

  1. Compare every version in A2.6 to A2.8, A2.5, A6.2.1 to A6.2.4 and A2.9 with vendor support dates.
  2. Renew any lapsed licences.
  3. Upgrade or remove unsupported software, or isolate it on a sub-set with no internet access (A6.7).
  4. Answer No only once nothing unsupported or unlicensed remains in scope.

How do assessors check A6.3?

What they look for
The assessor checks A6.3 against every version you list: the operating systems in A2, the software in A6.2.1 to A6.2.4 and the cloud services in A2.9. A No that the inventory contradicts is treated as a Yes. A Yes is a fail: IASME's FAQ says "any company using unsupported software in the scope of the assessment will fail to achieve Cyber Essentials certification". So fix or remove the software before you submit, or move it into a segregated sub-set under A6.7.

What evidence should you keep for A6.3?

The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A6.3:

  • A software inventory from MDM or RMM, checked against vendor support dates on the day you submit.

Where to go next

Other A6 questions

Frequently asked questions

A6.3 in the 2026 Danzell Cyber Essentials question set asks: "Are any of the in-scope software or cloud services unlicensed or unsupported?" It is a Yes/No question.

A compliant answer to A6.3 is No: every piece of software and every cloud service in scope must be licensed and still receive vendor security updates. A Yes means the requirement is not met, and the application will not pass until the software is removed or moved out of scope. Open-source software is acceptable within its licence terms.

Yes. The A6.3 guidance says free and open-source software is acceptable as long as you comply with its licensing requirements. It must still be supported: a project or distribution that no longer issues security fixes counts as unsupported.

Remove it from scope. The v3.3 requirements allow unsupported software to remain only on a defined sub-set that prevents all traffic to and from the internet. Describe how you achieve that at A6.7; otherwise A6.3 must be answered Yes, which means the requirement is not met and the application will not pass.

In effect, yes. The A6.3 guidance carries no automatic-fail wording, but IASME's FAQ says "any company using unsupported software in the scope of the assessment will fail to achieve Cyber Essentials certification". A Yes will not pass until the software is removed, upgraded or moved into a sub-set with no internet access.

It can. IASME's guidance warns that some operating systems, firmware and applications stop receiving security updates if the annual licence is not purchased, which makes them unsupported as well as unlicensed.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources