Unsupported software and Windows 10: the Cyber Essentials rule that fails you outright

What the rule says

The security-update control has two parts. First, everything in scope must be supported: every operating system on every device — including the firmware on routers and firewalls — and every application, must still be receiving security updates from whoever makes it (official questions A6.1 to A6.3). Second, important updates must be installed within 14 days (A6.4 and A6.5). The first part is where “unsupported” bites: an unsupported operating system anywhere in scope is a categorical fail, however good the rest of your answers are, because a device that cannot be patched has holes that will stay open forever. Which versions of Windows, macOS, iOS and Android currently count as supported — and the dates the next ones drop off — is kept in the supported operating systems reference.

Software must also be licensed (A6.3) — and unlicensed copies often stop getting updates. And the questionnaire asks you to confirm you have removed anything unsupported, or — if you genuinely must keep it — moved it out of scope onto a walled-off part of the network with no internet access (A6.6 and A6.7).

Windows 10

Microsoft ended support for Windows 10 on 14 October 2025 — no more security updates without Extended Security Updates (ESU). A device still running it without ESU enrolment is unsupported in Cyber Essentials terms, and fails the assessment. Microsoft’s ESU programme keeps Windows 10 receiving security updates for a limited further period while the subscription is active — and that does count, because the device is still being patched. Check Microsoft’s own pages for the exact ESU end date that applies to you; it is not indefinite, and when it ends the device becomes unsupported again.

The practical question for a small business is usually: can this laptop run Windows 11? Many machines from the last few years can and the upgrade is free; some older ones cannot because of hardware requirements, and those have to be replaced or removed from scope. Windows will tell you: open Settings → Windows Update and look for the upgrade offer, or run Microsoft’s PC Health Check app.

How to check what you are running

• Windows: Settings → System → About shows the edition and version. Write it down exactly — the questionnaire asks for the specific version.
• Mac: Apple menu → About This Mac shows the macOS version. Apple publishes which versions still receive security updates; anything older than those is unsupported.
• iPhone and iPad: Settings → General → About. Android: Settings → About phone. For iPhone and iPad, check the version still gets fixes on Apple’s security releases page; for Android, check the maker’s support period. Older phones stop getting updates even though they still work.
• Router or firewall: the admin page shows the firmware version; the maker’s support page shows whether the model is still updated.
• Applications: browsers, email and office apps, accounting software, anti-malware. Anything you installed years ago and never updated is worth a look.

Your three real options

There is no one-click fix for an unsupported operating system. The options are:

1. Upgrade it. Move the device to a supported version — Windows 10 to Windows 11 if the hardware allows, an old macOS to a current one, an old phone OS to the latest it will take. Often free.
2. Replace the device. If it is too old to upgrade, replace it with one that runs a current operating system. This is the one Cyber Essentials cost that can run to hundreds of pounds — and it is also the fix that actually protects the business.
3. Remove it from scope. If you genuinely must keep it — a machine that drives a specific piece of equipment, say — it has to be fully walled off: no internet access and separated from the rest of your network. This is more involved and changes how you describe your scope; it is not a loophole for “the old laptop in the cupboard”.

For Windows 10 specifically there is a fourth, temporary option: enrolling in Extended Security Updates keeps it supported for as long as the enrolment runs. That buys time; it does not remove the need to decide.

Unsupported applications

A program that is simply a version behind but still supported just needs updating. A program the maker has stopped supporting entirely needs one of the same three treatments: update to a supported (and properly licensed) version, remove it if nobody really needs it, or move it out of scope. “We don’t really use it any more” is not enough — if it is installed on an in-scope computer it counts, so it needs to actually come off. On Windows that is Settings → Apps → Installed apps → Uninstall; on a Mac, drag it from Applications to the Bin and empty the Bin. Repeat on every machine that has it.

The 14-day rule is the other half

Being supported is necessary but not sufficient. High-risk and critical security updates for operating systems, firmware and applications — and any security update the vendor hasn’t rated — must be installed within 14 days of release, and “no” to that question is an automatic fail as well. The reliable way to meet it is to switch on automatic updates everywhere — Windows Update, macOS Software Update, your browsers, and your router if it offers the option — and to restart when asked so the updates actually finish. Updating monthly, or when someone remembers, can miss the window.