Check your readiness
Question A6.6 · Security update management

A6.6: Have you removed software that is no longer supported?

Yes/No
Updated 3 November 2026
A6.6The question, word for word
Have you removed any software installed on your devices that is no longer supported and no longer receives regular updates or vulnerability fixes for security problems?

Compliant answerYes

Source: IASME Cyber Essentials Danzell question set v16.3

Short answer

Answer Yes to A6.6 only if every piece of software that has lost vendor support, has been removed from in-scope devices. If you must keep it, it has to sit in a sub-set with no internet access, described at A6.7. A No is a fail, because IASME's FAQ says "any company using unsupported software in the scope of the assessment will fail to achieve Cyber Essentials certification".

Is A6.6 an automatic fail?

No. IASME's guidance does not label A6.6 an automatic fail. But a No means the requirement that all software on in-scope devices must be licensed and supported is not met, and the assessor will not pass the application until the software is removed or moved into a sub-set with no internet access (A6.7).

Key facts
Compliant answer
Yes
Answer type
Yes/No a Yes/No question
IASME guidance
You must remove older software from your devices when it is no longer supported by the manufacturer. Such software might include older versions of web browsers, operating systems, and all application software.
Requirement enforced

All software on in-scope devices must be removed from devices when it becomes unsupported, or removed from scope by using a defined sub-set that prevents all traffic to/from the internet.

Outcome if non-compliant
A fail: IASME's FAQ says any company using unsupported software in scope will fail, so remove, upgrade or move the software out of scope first

What does A6.6 ask?

A6.6 asks: “Have you removed any software installed on your devices that is no longer supported and no longer receives regular updates or vulnerability fixes for security problems?”

A6.6 asks whether you have removed any software installed on your devices that is no longer supported and no longer receives regular updates or vulnerability fixes. The guidance says you must remove older software when it is no longer supported by the manufacturer, including older web browsers, operating systems and all application software.

The requirement behind it: all software on in-scope devices must be removed from devices when it becomes unsupported, or removed from scope by using a defined sub-set that prevents all traffic to and from the internet. The isolation option is described in A6.7. Check products with the is it supported tool.

What must be true to answer Yes to A6.6?

You can answer Yes to A6.6 only when all of the following are true today, across every device, user and cloud service in scope.

  • No in-scope device runs software past its vendor end-of-support date.
  • Old versions left behind after upgrades (a second Java runtime, an old browser) have been uninstalled.
  • Software you must keep is isolated on a sub-set with no internet access (A6.7).
  • The A6.2.1 to A6.2.4 lists contain only supported versions.

Why do applicants fail A6.6?

A common reason applicants fail A6.6: office 2016, 2019 or 2021 left installed alongside Microsoft 365 Apps.

Other reasons it fails
  • An unsupported line-of-business application on a shared PC.
  • Older Java runtimes left behind when a new one was installed.
  • Windows 10 devices without Extended Security Updates.

How do you fix a failing A6.6 answer?

If your answer to A6.6 would not pass today, fix the control first and then write the answer. In order:

  1. Run a software inventory and find anything past its vendor end-of-support date.
  2. Uninstall it, including old runtimes and browsers left after upgrades.
  3. Isolate anything you must keep on a sub-set with no internet access and describe it in A6.7.

How do assessors check A6.6?

What they look for
The assessor reads A6.6 with A6.3 and A6.7. A No, or a Yes contradicted by the version lists, means the licensed-and-supported requirement is not met and the application will not pass.

What evidence should you keep for A6.6?

The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A6.6:

  • The software inventory showing no unsupported versions, and records of removals.

Where to go next

Other A6 questions

Frequently asked questions

A6.6 in the 2026 Danzell Cyber Essentials question set asks: "Have you removed any software installed on your devices that is no longer supported and no longer receives regular updates or vulnerability fixes for security problems?" It is a Yes/No question.

Answer Yes to A6.6 only if every piece of software that has lost vendor support, has been removed from in-scope devices. If you must keep it, it has to sit in a sub-set with no internet access, described at A6.7. A No is a fail, because IASME's FAQ says "any company using unsupported software in the scope of the assessment will fail to achieve Cyber Essentials certification".

In effect, yes. Its guidance carries no automatic-fail wording, but IASME's FAQ says "any company using unsupported software in the scope of the assessment will fail to achieve Cyber Essentials certification". A No will not pass until the software is removed or moved out of scope.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources