Is your software still supported for Cyber Essentials?

Supported software is software you have a legal right to use and that a vendor has committed to support with regular vulnerability fixes, with a published future date when that support stops. The vendor does not need to have written the software originally. Once the end date passes, the software is unsupported.

No, not by that label. A6.3 asks whether any in-scope software or cloud service is unlicensed or unsupported, and A6.6 asks whether unsupported software has been removed. Neither carries automatic-fail wording in the Danzell guidance, but a non-compliant answer to either means the requirement that all in-scope software is licensed and supported is not met, so the application will not pass. Check every operating system and application before you submit.

The requirements allow three routes: upgrade to a supported version, remove the software from in-scope devices, or move the devices into a defined sub-set that prevents all traffic to or from the internet, declared under A6.7. The sub-set is the last resort for equipment that cannot be upgraded.

Yes. Question A6.1 itself states that the firmware of in-scope firewall and router devices is considered an operating system and must be supported by a vendor that produces regular security updates. Record the model and firmware version in the device list.

Only with Extended Security Updates you can evidence, or on an LTSC edition still in support. Windows 10 support ended on 14 October 2025, and the Danzell guidance for A2.6 and A6.1 says a Windows 10 device used after that date must be enrolled in Microsoft's ESU programme. Consumer ESU and commercial ESU year 2 both run to 12 October 2027.

Check Apple's security releases page and record the latest update for each version you run. If a version received a security update recently it is still being patched; if newer releases are patched and yours is not, treat it as unsupported. The A6.1 guidance names macOS Ventura and iOS 15 as examples of unsupported versions.

A2.6 to A2.8 ask for the operating systems on laptops, desktops, servers, tablets and phones, and A6.2.1 to A6.2.4 ask for the version of your browsers, malware protection, email applications and office applications. The assessor compares those versions against vendor lifecycle pages, so give exact versions rather than product names.

The dataset was last checked on 3 November 2026 against each vendor's lifecycle page, which is linked on every product page. Vendors do change dates, so confirm against the source if an end date falls close to your assessment.