If you are preparing for certification this year, the single question most likely to stop you is not about firewalls or passwords — it is about Cyber Essentials unsupported software. Every device, operating system, application, plug-in and piece of firmware inside your scope must still be receiving security updates from its vendor. One forgotten Windows 10 laptop, an old copy of Office 2016 on the finance PC, or a router whose manufacturer stopped publishing firmware three years ago is enough to turn a pass into a fail, and for Cyber Essentials Plus the assessor will find it on the sample devices they test.
This guide walks through the end-of-life problem the way we approach it with UK clients: what the scheme actually requires, how to build an honest inventory of what you run, how to decide between upgrading, paying for extended security updates, isolating or retiring each item, and how to keep the estate clean between annual renewals. You will find a practical timeline, a cost table, a twelve-point checklist and the mistakes we see most often — with the late-2025 wave of Microsoft end-of-support dates (Windows 10, Office 2016 and 2019, Exchange Server 2016 and 2019) as the running example, because it is the issue sitting in most UK estates right now.
What “unsupported software” means under Cyber Essentials
Cyber Essentials is the UK Government-backed baseline scheme run by the NCSC and delivered through IASME and its network of certification bodies. Its Security Update Management control has two halves. The first is about speed: high-risk and critical updates (vendor-rated critical or high, or CVSS v3 base score 7.0 and above) must be installed within 14 days of release. The second half — the one that catches people out — is that software in scope must be licensed and supported. “Supported” means the vendor is still producing security fixes for that product and version, and that you are entitled to receive them.
That definition is broader than most people expect. It covers desktop and server operating systems, mobile operating systems on any phone or tablet that touches organisational data or email, browsers and their extensions, office suites, PDF readers, line-of-business applications, Java and .NET runtimes, hypervisors, and the firmware on routers, firewalls and boundary devices. It does not matter whether the software still works; what matters is whether a newly discovered vulnerability would ever be fixed. Once a vendor stops shipping fixes, every future flaw becomes permanent, which is precisely why the scheme treats end-of-life software as an automatic non-compliance rather than a judgement call.
There are only three compliant outcomes for any end-of-life item: upgrade or replace it with a supported version; buy official extended support where the vendor sells it (Microsoft’s Extended Security Updates programme is the common case), which brings the item back inside “supported”; or remove it from scope by placing it in a segregated sub-set that has no route to or from the internet. Deleting it entirely is, of course, the fourth and often cheapest option. Anything else — “we’ll upgrade next quarter”, “it’s only used once a month”, “the antivirus covers it” — is a fail.
Read the question literally: the self-assessment asks whether all software in scope is licensed and supported, and whether unsupported software has been removed or segregated. If you cannot answer “yes” with a current inventory in front of you, fix the inventory before you book the assessment, not after.
Where UK estates typically stand on end-of-life risk
Before deciding how much work you have, it helps to score your estate honestly against the categories where end-of-life software hides. The score cards below reflect the pattern we tend to see when we run pre-assessment gap reviews for small and mid-sized UK organisations. The first card shows where risk usually concentrates; the second shows the controls that tend to be in good shape already; the third covers the grey areas that need a decision rather than a purchase.
Notice that the high-risk column is dominated by things bought once and then forgotten: perpetual licences, hardware appliances and personal phones. Subscription software and evergreen browsers keep themselves current; capital purchases do not. That is the core reason the end-of-life question tends to reappear at every annual renewal — the estate ages by a year whether or not anyone is watching it.
The key dates driving the 2026 end-of-life wave
Most organisations meet the unsupported-software rule at a specific moment: the month a widely used product leaves support. The autumn of 2025 bunched an unusual number of those moments together, which is why 2026 renewals feel harder than previous years. These are the dates worth pinning to the wall.
Two further dates matter for anyone still running servers on premises. Windows Server 2012 and 2012 R2 left extended support in October 2023, with paid ESU available only through specific routes such as Azure or Azure Arc. Windows Server 2016 reaches the end of extended support in January 2027 — which means a server you are certifying today will become a problem partway through your next certificate year unless you plan for it now. Exchange Server 2016 and 2019 also reached end of support in October 2025, leaving on-premises mail servers as one of the most exposed assets a small business can own.
Upgrade versus extended security updates: how the options compare
For Windows 10 in particular, most organisations are choosing between two routes for each device. Extended Security Updates keep a Windows 10 machine inside “supported” for Cyber Essentials purposes, provided the device is genuinely enrolled and receiving the ESU patches. Upgrading or replacing removes the problem permanently. The comparison below summarises the trade-off; neither route is wrong, but they suit different devices.
Windows 10 + ESU
Buy time on existing hardware
Windows 11 upgrade or refresh
Remove the problem permanently
The pragmatic answer for most SMEs is a mix: upgrade every machine whose hardware passes the Windows 11 requirements, replace the ones nearing five years old anyway, and buy ESU only for the handful of devices that genuinely cannot move yet — typically a PC driving a piece of laboratory or manufacturing equipment, or a machine running an application whose vendor has not certified Windows 11. ESU is a bridge, not a destination. Budget for it as a one-year cost with a named replacement date, and the certification body will see a credible plan rather than drift.
The same logic applies beyond Windows. Office 2016 and 2019 have no paid extension path; the only compliant routes are moving to Microsoft 365 Apps or Office LTSC 2024, or removing the software. On-premises Exchange 2016 and 2019 should, for most small organisations, simply become Exchange Online — running a supported mail server on premises is now a specialist undertaking that very few SMEs need.
Which unsupported items cause the most Cyber Essentials failures
When an application is returned for remediation, or a Cyber Essentials Plus test sample turns up a problem, the cause is rarely exotic. The bar chart below is an illustrative breakdown of the end-of-life findings we most often see in pre-assessment reviews — expressed as the share of reviewed estates in which each category produced at least one unsupported item. It is not a national statistic; it is a guide to where to look first.
Two patterns stand out. First, desktop operating systems are the headline but not the whole story: applications installed years ago — an old PDF editor, a standalone copy of Office installed for one user, a Java runtime that a long-retired application needed — are found almost as often. Second, the network edge is consistently under-checked. A broadband router supplied by an ISP, or a small-business firewall bought five years ago, may have reached its manufacturer’s end-of-life date without anyone noticing, because it still passes traffic perfectly well. If you want a deeper look at how network kit ages, our guide to network capacity planning for UK businesses covers refresh cycles in detail.
Mobile devices deserve a specific mention. Under the current requirements, any phone or tablet that accesses organisational data or services — including email — is in scope, whether the company owns it or not. Older Android handsets are the most frequent problem, because manufacturer update windows vary widely and many mid-range devices stop receiving security patches years before they stop working. If your organisation allows BYOD, you need a minimum supported OS version written into policy and enforced by your device management or conditional access rules.
How much of a typical estate needs action
A useful planning number is the proportion of in-scope devices that need some form of intervention before assessment. In the estates we review ahead of a 2026 renewal, a figure in the region of one device in three is common once phones, routers and old applications are counted alongside laptops. The donut below shows that illustrative planning figure; your own number is the first thing an inventory will tell you.
The important point is not the exact percentage but the shape of the work. A third of devices needing action does not mean a third of devices need replacing. In practice, the majority of interventions are cheap: uninstalling software nobody uses, pushing a feature update, applying router firmware, or tightening a mobile policy. Hardware replacement is usually the minority, and it can often be absorbed into a normal refresh cycle if the inventory is done early enough in the year.
How to remove unsupported software from scope: a step-by-step timeline
The timeline below is the sequence we follow when a client has an assessment date in the diary and an estate with unknown end-of-life exposure. Eight weeks is comfortable for a 20–80 person organisation; it can be compressed, but the inventory and the decision step should never be skipped.
Two practical notes on the segregation step. First, “no internet access” means exactly that: the out-of-scope segment cannot browse, cannot receive email, and cannot be reached from the internet, including through remote-access tools. A device that is isolated except for a vendor’s remote-support connection is not isolated. Second, the segregated devices must be described in your scope statement; you are telling the certification body that the certificate does not cover them, and that is visible to anyone who checks it. For a fuller explanation of how scope statements work, see our Cyber Essentials scope definition guide.
Readiness benchmark: how close is your estate to a clean pass?
Once the inventory is in hand, a simple score helps you judge whether you are ready to submit. We weight five factors: inventory completeness, the share of flagged items with a decision recorded, the share already remediated, the quality of segregation for anything left, and whether a repeatable process exists to stop the problem recurring. The gauge below shows the threshold we generally recommend reaching before booking an assessment.
Why not 100? Because the final points usually come from evidence and process rather than from technology, and those are easier to finish in the week before submission. What you must not do is book with a score in the fifties and hope the questionnaire does not ask. Under Cyber Essentials Plus in particular, the assessor checks a sample of real devices; if the sample includes the one laptop nobody upgraded, that becomes a finding regardless of what the questionnaire said.
What dealing with end-of-life software costs a UK SME
Costs vary with estate size and how far behind the estate has fallen, but the categories are predictable. The table below gives indicative 2026 ranges for a 25–50 person UK organisation, excluding VAT. Use it to frame a budget conversation, then replace the ranges with real quotes once your inventory tells you how many of each item you have.
| Remediation route | Typical unit cost | When it fits | Ongoing cost |
|---|---|---|---|
| Uninstall unused software / extensions | Staff or support time only | Anything nobody can name a current user for | None |
| Windows 10 to Windows 11 in-place upgrade | £0 licence; roughly £30–£80 per device in labour | Hardware passes TPM 2.0 and CPU checks | Annual feature update testing |
| Replacement business laptop | £650–£1,200 per device plus setup | Hardware fails Windows 11 checks or is 5+ years old | Normal refresh cycle |
| Windows 10 ESU (organisations) | Around US$61 per device in year one, doubling each year | Devices that genuinely cannot move this year | Rising sharply in years two and three |
| Office 2016 / 2019 to Microsoft 365 Apps | From roughly £10–£20 per user per month depending on plan | Any perpetual Office install | Subscription |
| Replacement firewall or router | £400–£2,500 depending on throughput and licensing | Manufacturer has stopped publishing firmware | Security subscription on some platforms |
The single biggest cost driver is time. An organisation that inventories in January can fold most replacements into a planned refresh and negotiate hardware prices; one that discovers the problem a fortnight before its certificate expires ends up paying for rushed procurement, out-of-hours engineering and, sometimes, ESU on machines that should simply have been replaced. If your certificate is tied to a contract or an insurance renewal, the cost of a lapse usually exceeds all of the line items above combined. Our article on Cyber Essentials and insurance premiums explains why insurers look closely at the same controls.
Do not forget data-handling costs when devices are retired. Laptops leaving the business need certified data destruction, and backups taken from old servers need to be retained, migrated or securely deleted in line with your retention policy. Our guide to backup encryption for UK businesses covers how to handle the archive side safely.
Benchmarks: patch and support hygiene across a well-run estate
Passing once is one thing; staying compliant across the year is another. The progress rows below show the targets we suggest for an organisation that wants its next renewal to be uneventful. They are working targets rather than scheme requirements, except where noted — but each one maps directly to a question the assessor will ask.
Recommended year-round targets for a Cyber Essentials estate
The most useful single metric on that list is the second-from-top working target: the proportion of software titles with a recorded end-of-support date. Once every product in your inventory carries a date, end-of-life stops being a surprise and becomes a line in a forward calendar. A virtual CIO or IT manager can then roll the next twelve months of expiries into the budget, which is exactly the kind of planning we describe in what a virtual CIO does in the first 90 days.
Common end-of-life mistakes that cost certifications
Most failures on this control are not technical. They come from assumptions about what counts, what is in scope, or what an extended support arrangement covers. These are the mistakes we see most often.
- Assuming Windows 10 ESU is automatic. ESU must be purchased and the device must be activated and actually receiving the updates. A licence on a spreadsheet does not make a machine supported; the patch history on the device does.
- Forgetting perpetual Office. Many organisations moved email to Microsoft 365 years ago but left Office 2016 or 2019 desktop apps installed on a few machines. Those installs are now unsupported even though Outlook still connects.
- Ignoring the router. ISP-supplied routers and older small-business firewalls are boundary devices and fully in scope. If the manufacturer has published an end-of-life notice, the device must be replaced.
- Leaving personal phones out of the conversation. A staff member’s five-year-old Android phone with email on it is in scope under BYOD. Without a minimum-OS rule enforced through conditional access, you cannot answer the question honestly.
- “Isolating” a device that still has remote support. A legacy PC on its own VLAN that still allows a vendor’s remote-access tool through the firewall is not segregated from the internet and remains in scope.
- Keeping old runtimes “just in case”. Old Java, Flash-era plug-ins and outdated .NET runtimes linger after the application that needed them is gone. If nothing depends on them, uninstall them.
- Checking support status only at renewal. Products leave support mid-year. An item that was supported on the day you certified can become a non-compliance six months later, and your certificate statement is expected to remain true throughout the year.
Answering the self-assessment inaccurately is worse than failing. The questionnaire is signed off by a board-level or equivalent senior person, and a misstatement can undermine insurance claims or contract warranties that rely on the certificate. If something is unsupported on the day you submit, say so and fix it before re-submitting.
Cyber Essentials end-of-life checklist — the 12-point essentials
Use this checklist as the working document for your next renewal. Each item is something an assessor may ask about or test, and each can be evidenced with a report, a screenshot or a policy extract.
- Write a scope statement listing every location, network, cloud service and device type covered by the certificate.
- Produce an automated inventory of operating systems and installed software for every in-scope laptop, desktop and server.
- List every router, firewall and other boundary device with its model and current firmware version.
- List every phone and tablet that accesses organisational email or data, including personally owned devices.
- Record the vendor end-of-support date for every product and version in the inventory.
- Uninstall every application, extension and runtime that no one can name a current business use for.
- Upgrade or replace every Windows 10 device, or enrol it in ESU with a named replacement date.
- Replace perpetual Office 2016 and 2019 installs with Microsoft 365 Apps or another supported version.
- Replace any network device whose manufacturer has stopped publishing firmware updates.
- Enforce a minimum supported OS version for mobile access through device management or conditional access.
- Place any genuinely un-updatable kit in a segregated sub-set with no internet access in either direction, and document it in scope.
- Schedule a quarterly inventory review and a twelve-month forward view of upcoming end-of-support dates.
The checklist is deliberately vendor-neutral. The same steps apply to macOS (where Apple in practice supports only recent major versions with security fixes), Linux distributions with fixed support windows, and specialist software with its own lifecycle policy. The principle is identical: every product in scope needs a vendor still issuing security fixes for the version you run.
Mini case study: a Midlands engineering firm clears its legacy estate
A 42-person precision engineering business in the West Midlands approached its 2026 Cyber Essentials Plus renewal knowing it had “a few old machines”. The inventory found rather more: eleven Windows 10 laptops, three of which failed the Windows 11 hardware checks; six perpetual Office 2019 installs left over from before the firm moved to Microsoft 365; an ISP router the manufacturer had stopped supporting; seven personal phones on operating systems no longer receiving security updates; and two PCs driving CNC machines that ran Windows 10 because the machine-tool vendor had not certified anything newer.
The firm took a mixed approach. The eight qualifying laptops were upgraded in place over two evenings. The three ageing laptops were replaced as part of a refresh already planned for the summer, brought forward by four months. The Office 2019 installs were removed, as every user already held a Microsoft 365 licence that included the desktop apps. The router was replaced with a supported business firewall. Staff with older phones were offered a choice of upgrading or accessing email only through managed company handsets, and conditional access enforced the minimum OS version from the start of the following month. The two CNC PCs were moved to a dedicated VLAN with no internet route, and CAD files are now transferred to them through a controlled internal share rather than USB sticks.
“We assumed the hard part would be the machines on the shop floor. In the end those were the simplest — they didn’t need the internet at all. The time went on the bits nobody thought of: the router in the comms cupboard and the phones in people’s pockets.” — Operations director, West Midlands engineering firm
The assessment passed first time, and the firm now reviews its inventory every quarter as part of a standing agenda item. The lesson is common to most of the estates we see: the visible problem is rarely the largest one, and an honest inventory is worth more than any single purchase.
At a glance: Cyber Essentials and end-of-life software
| Topic | Key fact |
|---|---|
| Core rule | All software in scope must be licensed and supported by its vendor |
| Update deadline | Critical and high-risk updates installed within 14 days of release |
| What counts as software | Operating systems, applications, plug-ins, runtimes and network device firmware |
| Compliant outcomes | Upgrade, replace, buy vendor extended support, remove, or segregate out of scope |
| Segregation standard | No internet traffic in or out, documented in the scope statement |
| Windows 10 | End of support 14 October 2025; ESU available to organisations for up to three years |
| Office 2016 / 2019 | End of support 14 October 2025; no paid extension route |
| Exchange Server 2016 / 2019 | End of support October 2025; most SMEs should move to Exchange Online |
| Windows Server 2016 | Extended support ends January 2027 — plan now for renewals during 2026 |
| Mobile devices | In scope when they access organisational data, including BYOD |
| Cyber Essentials Plus | Assessor tests a sample of real devices; unsupported software found there is a finding |
| Good practice | Record an end-of-support date for every title and review quarterly |
How Cloudswitched helps with Cyber Essentials end-of-life remediation
Cloudswitched supports UK organisations through the whole Cyber Essentials journey, from the first gap analysis to the assessment itself. For end-of-life software, that means running the automated inventory, mapping every product to its vendor lifecycle date, recommending the most economical route for each item, and carrying out the upgrades, replacements, network segregation and evidence-gathering so you go into assessment with an estate that matches your answers. We can also stay on afterwards to run the quarterly review, so the next renewal starts from a known position.
Clear your unsupported software before assessment day
Our Cyber Essentials team can inventory your estate, plan the remediation and prepare the evidence your certification body will ask for.
Talk to us about Cyber EssentialsFrequently Asked Questions
Can I pass Cyber Essentials with Windows 10 devices?
Yes, but only if those devices are enrolled in Microsoft’s Extended Security Updates programme and are actually receiving the ESU patches, or if they are placed in a segregated sub-set with no internet access and declared out of scope. A Windows 10 device without ESU that can reach the internet is unsupported software in scope, and that is a fail under the security update management control. For most organisations the better long-term answer is to upgrade qualifying machines to Windows 11 and replace the rest.
Does Cyber Essentials accept Windows 10 Extended Security Updates?
Extended Security Updates are vendor-provided security fixes, so a properly enrolled device is treated as supported. The key words are “properly enrolled”: you need the licence, the activation on each device, and evidence that the monthly ESU updates are being installed within the 14-day window. Keep a report from your management tooling showing ESU status per device, and treat ESU as a temporary bridge with a dated replacement plan rather than a permanent arrangement.
What counts as unsupported software for Cyber Essentials?
Any software for which the vendor no longer issues security updates for the version you are running. That includes operating systems, office suites, browsers and extensions, PDF readers, runtimes such as Java, line-of-business applications, mobile operating systems and the firmware on routers and firewalls. Software also needs to be licensed, so unlicensed or pirated copies fail the same requirement even if updates are technically available.
How do I remove an old device from Cyber Essentials scope?
Place it in a segregated sub-set — typically its own VLAN or physically separate network — with firewall rules that block all traffic to and from the internet, and describe that sub-set in your scope statement as excluded. The device must not be able to browse, receive email or be reached through remote-access tools. Remember that excluded devices are visible in the scope description on your certificate, so customers checking it will see what is not covered.
Are personal phones in scope for unsupported software checks?
Yes, if they access organisational data or services, including email and Microsoft 365. That makes BYOD phones subject to the same requirement as company devices: they must run a vendor-supported operating system and receive security updates within the 14-day window. Most organisations handle this by setting a minimum OS version in policy and enforcing it through mobile device management or conditional access, so outdated phones simply cannot connect.
Is my router or firewall firmware part of Cyber Essentials?
Yes. Boundary firewalls and internet routers are central to the scheme, and their firmware is software like any other. If the manufacturer has stopped publishing firmware for the model, the device is unsupported and needs replacing. ISP-supplied routers are a frequent blind spot, so check the model against the manufacturer’s end-of-life notices and confirm who is responsible for applying updates.
What happens if software goes end-of-life during my certificate year?
Your certificate reflects your answers at the time of assessment, but the expectation is that you continue to operate the controls throughout the year. If a product leaves support mid-year, you should upgrade, replace, remove or segregate it promptly. In practice, keeping a forward view of end-of-support dates for the next twelve months means these items are planned before they lapse, and nothing unexpected is waiting at renewal.
Does Cyber Essentials Plus test for end-of-life software?
Yes. The Cyber Essentials Plus technical audit includes checks on a sample of in-scope devices, and the assessor will look at operating system versions, installed software and update status. Unsupported software found on a sampled device is a finding that must be remediated within the assessment window. That is why the inventory needs to be complete across the estate, not just tidy on the devices you expect to be chosen.
How much does it cost to fix unsupported software before Cyber Essentials?
It depends on how many items need action and which route each one takes. Uninstalling unused software costs only time, a Windows 11 in-place upgrade on qualifying hardware has no licence cost, and moving perpetual Office to Microsoft 365 Apps is a monthly subscription. Hardware replacement and firewall upgrades are the larger costs. Starting early in the year lets most replacements fall within a normal refresh budget rather than becoming emergency spend.
Is Office 2019 still allowed for Cyber Essentials?
No. Office 2016 and Office 2019 reached end of support on 14 October 2025 and there is no paid extension programme for them. Devices with those versions installed in scope will not meet the requirement. The usual fix is to remove the old installation and use Microsoft 365 Apps, which many organisations are already licensed for, or to move to a currently supported standalone version such as Office LTSC 2024.
Related reading
These recent articles cover the adjacent decisions that come up when you tidy an estate for certification.
Ready for a clean Cyber Essentials renewal?
Cloudswitched can audit your estate for end-of-life software, carry out the remediation and support you through Cyber Essentials or Cyber Essentials Plus assessment.
Explore our Cyber Essentials service
Cloudswitched
London-based managed IT services provider offering support, cloud solutions and cybersecurity for SMEs.
