Which operating systems count as supported for Cyber Essentials?

The rule, as the requirements state it

The NCSC’s Requirements for IT Infrastructure (v3.3, April 2026) puts operating systems under the Security Update Management control. All software on in-scope devices must “be licensed and supported”, must be removed from devices when it becomes unsupported (or moved into a segregated sub-set with no internet traffic), must have automatic updates turned on where possible, and must receive fixes for high and critical vulnerabilities within 14 days of release.

The document then defines the key word. Paraphrased: software is supported when you have a legal right to use it and the vendor has committed to providing regular vulnerability fixes, with a published future date on which those fixes will stop. The vendor does not have to be the original author, but it must be able to change the software to fix it. So the test is never “is this version old?” — it is “does the maker still ship security updates for it, and have they said when that ends?”

In the 2026 question set you list each operating system and version at A2.6 (computers), A2.7 (servers) and A2.8 (phones and tablets); A6.1 then asks whether every one is supported, and follow-up questions cover unsupported software. An unsupported operating system still in scope is an automatic fail — the unsupported software guide explains the mechanics and the three ways out.

Windows

Microsoft publishes exact end dates, which makes Windows the easiest case and also the one most businesses trip over. As of 7 September 2026, from Microsoft’s own lifecycle pages:

Two things to note. Windows 11 is not one product: each yearly version has its own end date, and a Home or Pro laptop that has quietly stayed on 24H2 lost support on 13 October 2026 even though “Windows 11” is current. Check Settings → System → About, or run winver, and read the version line. The Windows 11 guide has every version’s end date and how to move a PC to 25H2. And Windows 10 is only supported while a device is actually enrolled in Microsoft’s ESU programme. Microsoft’s consumer ESU page states that programme ends on 12 October 2027. If your business bought commercial ESU instead, it is sold one year at a time (for up to three years), and a device counts only while the year you’ve paid for is current — check each year’s end date on Microsoft’s ESU page. Enterprise and Education editions follow their own dates on the same Microsoft pages.

Windows Server follows the same logic. Server 2012 and 2012 R2 reached end of support in October 2023 and fail unless covered by a current Extended Security Updates subscription. Server 2016’s extended support ends on 12 January 2027, after which it no longer counts as supported; 2019, 2022 and 2025 still receive security updates and so still count — check the exact date for your edition on Microsoft’s lifecycle site before you answer.

macOS, iOS and iPadOS

Apple does not publish end-of-support dates, which sits awkwardly with the requirement’s “published future date” wording. What Apple does publish is its security releases page, and a reasonable working rule, in line with A6.1’s advice to always check with the vendor, is that a version is supported while it is still receiving those updates. On 7 September 2026 that page showed 2026 security updates for macOS Tahoe (26), macOS Sequoia (15) and macOS Sonoma (14); Ventura (13) and older had dropped off. For phones and tablets it showed iOS and iPadOS 26 as current, with iOS and iPadOS 18 still receiving fixes for devices that cannot run 26.

The practical consequence: a Mac or iPhone that cannot install a version Apple is still patching is unsupported for Cyber Essentials, however well it works. Apple menu → About This Mac, or Settings → General → About, shows what you are on. The macOS guide covers the rest of the Mac questions, and IASME’s Knowledge Hub is where to look if you need the scheme’s current position on Apple in writing.

Android

Android is different again because support belongs to the device maker, not to Google. Google’s platform page listed Android 16 as the newest stable release on 7 September 2026, with Android 17 in preview, but a phone on Android 14 from a maker that still ships monthly security patches is supported, and a phone on Android 16 whose maker has stopped patching it is not. The evidence is on the device: Settings → Security (or Security & privacy) → the “Android security update” date. If that date is more than about three months old, the maker has probably stopped, and you should check their published support period for the model. Samsung and Google state these periods per device; many cheaper brands do not, which is itself a warning sign. The mobile devices guide and the BYOD guide cover phones in scope more fully.

Linux and ChromeOS

Linux distributions publish support windows per release — an Ubuntu LTS, for example, has a stated end date for standard security updates — and the same test applies: in support with a published end date, or out. Chromebooks have a per-model Auto Update Expiration date that Google lists publicly; a Chromebook past that date is unsupported however new the browser looks.

How to list versions (A2.6–A2.8) and answer A6.1

• List versions, not names. “Windows 11 Pro 25H2”, “macOS 15.7”, “iOS 26” — the assessor needs the version to apply the rule.
• Check every device, including the spare. The laptop in the cupboard that still boots is in scope if it can reach the internet.
• Note ESU enrolments explicitly. A Windows 10 machine on ESU is a different answer from a bare Windows 10 machine.
• Fix before you submit. Updating 24H2 to 25H2, or a Mac to a patched release, takes an afternoon; an unsupported entry on the form is a fail you can see coming.
• Re-check at renewal. These dates move every year — the version that was supported last time may not be this time.