A6.3.1: Which software or cloud services are unsupported or unlicensed?
If yes to A6.3, please list the unsupported or unlicensed software or cloud services.
Source: IASME Cyber Essentials Danzell question set v16.3
A6.3.1 appears if you answered Yes to A6.3. List every unsupported or unlicensed product or cloud service in scope, with versions and device counts. Listing it is honest, but it does not make it compliant: the licensed-and-supported requirement is still not met until the software is removed, upgraded or moved into a sub-set with no internet access.
Is A6.3.1 an automatic fail?
No. A6.3.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- IASME provides no additional guidance for this question.
- Logic
- If yes to A6.3
- Requirement enforced
- Security Update Management: Ensure that devices and software are not vulnerable to known security issues for which fixes are available.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A6.3A6.4AUTO-FAILBack to the security update management control
What does A6.3.1 ask?
A6.3.1 asks: “If yes to A6.3, please list the unsupported or unlicensed software or cloud services.”
A6.3.1 asks, if you answered Yes to A6.3, for a list of the unsupported or unlicensed software or cloud services. IASME provides no further guidance.
The requirement is unconditional: all software on in-scope devices must be licensed and supported, and removed when it becomes unsupported or removed from scope by a defined sub-set that prevents all traffic to and from the internet. Use this list as your remediation plan, then fix it before you submit, or describe the isolation in A6.7.
What should you write in the notes field for A6.3.1?
Write two to four specific sentences for A6.3.1: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
[Product and version], on [n] devices, [unsupported since date / licence expired on date]. Action: [to be removed by date / isolated on the sub-set described in A6.7]. (If this list is not empty on the day you submit, the application will not pass.)
Why do applicants fail A6.3.1?
A common reason applicants fail A6.3.1: submitting with items listed, expecting the assessor to accept a remediation date.
- Listing Windows 10 devices that could be fixed by enrolling in Extended Security Updates.
- A list that does not match the versions in A2.6 to A2.8 and A6.2.1 to A6.2.4.
- Leaving items off the list to keep it short.
How do you fix a failing A6.3.1 answer?
If your answer to A6.3.1 would not pass today, fix the control first and then write the answer. In order:
- Use the list as your remediation plan: product, version, devices and the action for each.
- Remove, upgrade, relicense or isolate every item.
- Change A6.3 to No once the list is empty, before you submit.
How do assessors check A6.3.1?
What evidence should you keep for A6.3.1?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A6.3.1:
- The remediation record showing each listed item removed, upgraded or isolated.
Where to go next
- Is it supported?Check a product's support status
- RemediationGlossary
- CE Plus test 2: authenticated patch scanHow the 14-day rule is tested
- Security Update Management requirementsThe control this question tests
- All A6 questionsSecurity update management
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A6 questions
- A6.2.4A6.2.4NotesPlease list all office applications that are used to create organisational data.Notes
- A6.3A6.3Yes/NoAre any of the in-scope software or cloud services unlicensed or unsupported?Yes/No
- A6.4A6.4Auto-failAre all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?Auto-fail
- A6.4.1A6.4.1Yes/NoAre all updates applied for operating systems by enabling auto updates?Yes/No
Frequently asked questions
A6.3.1 in the 2026 Danzell Cyber Essentials question set asks: "If yes to A6.3, please list the unsupported or unlicensed software or cloud services." It is a notes question, answered in free text.
A6.3.1 appears if you answered Yes to A6.3. List every unsupported or unlicensed product or cloud service in scope, with versions and device counts. Listing it is honest, but it does not make it compliant: the licensed-and-supported requirement is still not met until the software is removed, upgraded or moved into a sub-set with no internet access.
No. A6.3.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
No. Listing it does not make it compliant. Remove or upgrade it, or isolate it on a sub-set with no internet access, before you submit.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh