A6.7: How have you moved unsupported software out of scope?
Where you have a business need to use unsupported software, have you moved the devices and software out of scope of this assessment? Please explain how you achieve this.
Source: IASME Cyber Essentials Danzell question set v16.3
A6.7 asks how any unsupported software you need to keep has been moved out of scope. It must sit on its own sub-set, segregated by firewall or VLAN, with no internet access. If that sub-set can still reach the internet, you cannot certify the whole organisation and must choose partial in A2.1. If you use no unsupported software, say so.
Is A6.7 an automatic fail?
No. A6.7 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- Software that is not removed from devices when it becomes un-supported will need to be placed onto its own sub-set with no internet access. 1.
- Requirement enforced
All software on in-scope devices must be removed from devices when it becomes unsupported, or removed from scope by using a defined sub-set that prevents all traffic to/from the internet.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A6.6A7.1Back to the security update management control
What does A6.7 ask?
A6.7 asks: “Where you have a business need to use unsupported software, have you moved the devices and software out of scope of this assessment? Please explain how you achieve this.”
A6.7 asks, where you have a business need to use unsupported software, whether you have moved the devices and software out of scope, and how. The guidance says unsupported software not removed from devices must be placed on its own sub-set with no internet access, and that if the out-of-scope sub-set remains connected to the internet you will not be able to achieve whole company certification and must select 'Partial Organisation' in A2.1.
A sub-set is part of the organisation whose network is segregated from the rest by a firewall or VLAN. Where no unsupported software is used across the whole organisation, the guidance asks you to declare that here. See network segregation and sub-set.
What should you write in the notes field for A6.7?
Write two to four specific sentences for A6.7: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
No unsupported software is used anywhere in the organisation. (Or: [n] x [device] running [unsupported software] control [machinery / lab equipment] at [site]. They are on a dedicated [VLAN n / network behind firewall make and model] with no route to the internet and no access to organisational email or cloud services. Data is transferred by [method]. The scope is declared as partial in A2.1, and the sub-set is described in A2.2.1 and A2.2.2.)
Why do applicants fail A6.7?
A common reason applicants fail A6.7: an isolated network that can still reach the internet for 'vendor support'.
- Isolation by Windows Firewall or security groups rather than a firewall or VLAN.
- Choosing whole organisation in A2.1 while keeping an internet-connected sub-set.
- Leaving A6.7 blank instead of declaring that no unsupported software is used.
How do you fix a failing A6.7 answer?
If your answer to A6.7 would not pass today, fix the control first and then write the answer. In order:
- If you have no unsupported software, say so here.
- Otherwise, put the devices on their own VLAN or behind a firewall with no route to the internet.
- Remove email and cloud access from those devices.
- If the sub-set still needs internet access, choose partial organisation in A2.1 and describe it in A2.2 to A2.2.2.
How do assessors check A6.7?
What evidence should you keep for A6.7?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A6.7:
- A network diagram of the isolated sub-set and the firewall or VLAN configuration that blocks internet access.
Where to go next
- Sub-setGlossary
- Network segregationGlossary
- VLANGlossary
- Is it supported?Check a product's support status
- CE Plus test 2: authenticated patch scanHow the 14-day rule is tested
- Security Update Management requirementsThe control this question tests
- All A6 questionsSecurity update management
- Cyber Essentials checklistThe evidence to gather for every question
Other A6 questions
- A6.5A6.5Auto-failAre all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release?Auto-fail
- A6.5.1A6.5.1Yes/NoAre all updates applied on your applications by enabling auto updates?Yes/No
- A6.5.2A6.5.2NotesWhere auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all software are applied within 14 days of release?Notes
- A6.6A6.6Yes/NoHave you removed any software installed on your devices that is no longer supported and no longer receives regular updates or vulnerability fixes for security problems?Yes/No
Frequently asked questions
A6.7 in the 2026 Danzell Cyber Essentials question set asks: "Where you have a business need to use unsupported software, have you moved the devices and software out of scope of this assessment? Please explain how you achieve this." It is a notes question, answered in free text.
A6.7 asks how any unsupported software you need to keep has been moved out of scope. It must sit on its own sub-set, segregated by firewall or VLAN, with no internet access. If that sub-set can still reach the internet, you cannot certify the whole organisation and must choose partial in A2.1. If you use no unsupported software, say so.
No. A6.7 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Yes, if it is on a sub-set segregated by firewall or VLAN with no internet access. That sub-set is then out of scope.
Then IASME's A6.7 guidance says you cannot achieve whole company certification and must choose 'Partial Organisation' in A2.1.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh