Unsupported software: what fails Cyber Essentials

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

The v3.3 rule on licensed and supported software

Section B (page 4) and Section E.3 (page 17) of the NCSC Requirements for IT Infrastructure v3.3 define licensed and supported software as software you have a legal right to use and that a vendor has committed to support by providing regular vulnerability fixes, with a published future end-of-support date.

Under the April 2026 Danzell update, IASME also clarified that “point in time” means the date your certificate is issued. If an operating system or application reaches end of support while your assessment is still being marked, it fails.

Common end-of-life software that catches UK firms out in 2026

Does Windows 10 with paid Extended Security Updates (ESU) pass?

Yes, as a temporary bridge. Because v3.3 defines supported software as software where the vendor has committed to providing regular vulnerability fixes with a published future stop date, a Windows 10 Pro or Enterprise PC enrolled in Microsoft’s commercial ESU programme (Year 2 runs to 12 October 2027; Year 3 to 10 October 2028) is still supported — provided those updates are installed within 14 days. Remember two catches: (1) Microsoft’s consumer ESU cannot be used on commercial or Entra-joined PCs, and (2) under Danzell’s new director declaration, if your ESU subscription expires mid-year you must renew it or replace the PC before it lapses.

How to find unsupported software across your fleet

• Microsoft Defender Vulnerability Management: In security.microsoft.com → Vulnerability management → Inventories, filter by End-of-support software. It flags old Office installs, retired runtimes (.NET, Java, Silverlight), and legacy OS builds across every enrolled machine.
• Microsoft Intune Discovered Apps: In intune.microsoft.com → Apps → Monitor → Discovered apps, export the full software list across Windows, macOS, iOS and Android.

Your three options: upgrade, remove or isolate

1. Upgrade (best): Upgrade eligible PCs to Windows 11 for free, move old Office 2016, 2019 or 2021 installs to Microsoft 365 Apps or Office 2024, and replace end-of-life routers or phones.
2. Remove (fastest for unused apps): Often an old copy of Office 2016, SQL Server Express or Java is sitting unused on a laptop alongside newer software. Uninstalling it removes the failure immediately at zero cost.
3. Isolate in an out-of-scope sub-set (last resort for specialist machinery): If a legacy PC controls a CNC machine or laboratory instrument and cannot be upgraded, v3.3 (page 17) allows you to move it into a segregated network sub-set (behind a firewall or VLAN) that prevents all traffic to or from the internet, and declare that exclusion in your scope.