Cyber Essentials on Windows 11: which versions count, and what to check on each PC

Which Windows 11 versions count as supported (A6.1)

Question A6.1 asks whether every operating system in scope is supported by a vendor that produces regular security updates, and an unsupported one is an automatic fail. For Windows 11 the answer depends on the version and the edition, not the name: Microsoft services each Home and Pro version for 24 months and each Enterprise and Education version for 36 months, and publishes the date each version’s security updates end. As of 25 September 2026, from Microsoft’s release-health page and IASME’s own Windows 11 page:

Pro Education and Pro for Workstations follow the Home and Pro dates. Once a date has passed, that version is unsupported for Cyber Essentials however new the PC is. 26H1 comes only on some new devices released in 2026 — Microsoft doesn’t offer it as an update to existing PCs — so for most machines the version to be on is 25H2. The rarer LTSC editions have longer, separate dates on the same Microsoft page. The supported operating systems reference has Windows 10, Windows Server, Apple and Android alongside.

Check the version on each PC (A2.6)

Start → Settings → System → About, and read Edition and Version under Windows specifications — or press Windows + R and run winver. Write both into your asset register as “Windows 11 Pro 25H2”, not “Windows 11”: A2.6 asks for each device’s operating system, and the assessor needs the version and edition to apply the dates above.

Moving a 24H2 PC to 25H2

Settings → Windows Update. When “Windows 11, version 25H2” is offered, choose Download and install. From 24H2 it is a small update: Microsoft delivers 25H2 to 24H2 PCs as an enablement package that switches on files the monthly updates have already installed. A PC still on 23H2 or earlier needs the full upgrade, which takes longer. If 25H2 isn’t offered, install the latest monthly update, restart and check again; Microsoft sometimes holds an update back from particular hardware while it fixes a compatibility problem, so if it still isn’t there, ask whoever supports your IT well before the end date.

A PC that can’t run a supported Windows 11 version is the same decision as any unsupported device: upgrade, replace, or take it out of scope. Windows 10 counts only while the PC is enrolled in Microsoft’s Extended Security Updates programme — the question set says so in plain terms under A6.1.

1. Updates on, and never paused past 14 days (A6.4, A6.4.1)

Settings → Windows Update. Automatic updates are on by default; the thing to check is Pause updates. Windows lets you pause for weeks at a time, and a pause that runs past 14 days means a high-risk fix isn’t installed in time — an automatic fail at A6.4. Restart when asked, too: an update waiting for a restart isn’t installed yet. Feature updates don’t have to land within 14 days (the question set says so), but the yearly version update does have to happen before the old version’s end date. Apps are separate (A6.5): Store apps update from the Microsoft Store’s own settings, and other apps through their own. The 14-day patching guide covers the rule in full.

2. Firewall on for every network type (A4.1.1)

Windows Security → Firewall & network protection: Domain, Private and Public networks should each show the firewall as on. It is on by default; if another security product manages the firewall instead, Windows Security names it, and that one needs to be on. This matters most on laptops used at home and in cafés, where no office router sits in front of them.

3. Microsoft Defender on and updating (A8.1–A8.3)

Windows Security → Virus & threat protection → Manage settings: Real-time protection on. Defender keeps itself updated through Windows Update. The question set itself confirms that Windows Defender is suitable for the anti-malware option (A8.2) — you don’t need to buy anything. For the malicious-websites question (A8.3) it names Microsoft Defender SmartScreen: Windows Security → App & browser control → Reputation-based protection settings, with SmartScreen switched on. The malware guide explains both options.

4. A standard account for everyday work (A7.6, A7.7)

The first account on a new Windows PC is an administrator, and plenty of small businesses work in it every day without realising. Cyber Essentials needs admin tasks done from a separate account that is never used for email or browsing — IASME’s guidance is that even a one-person business needs two accounts. Settings → Accounts → Other users → Add account to create the admin account; then select the everyday account → Change account type → Standard User. From then on Windows asks for the admin password when something needs installing, which is the point. The user-access guide covers the rest of the admin rules.

5. Sign-in, PIN and screen lock (A5.9, A5.10)

Settings → Accounts → Sign-in options. Every PC needs a PIN, password, fingerprint or face before anyone at the keyboard can use it. Make it lock when left: under Additional settings, set “If you’ve been away, when should Windows require you to sign in again?” to when the PC wakes from sleep, and set a short screen and sleep time in Settings → System → Power. The scheme sets no time limit; a few minutes is sensible.

A Windows Hello PIN is tied to the PC it was set up on — Microsoft’s documentation says it can’t be used anywhere else — so where it only unlocks the PC and work apps still ask for their own sign-in, the device-unlock rule applies: at least 6 characters (A5.10). Windows can be set to accept 4 digits, so check. Guessing is handled by Windows itself: Microsoft says the security chip locks the PIN after too many wrong attempts, with the wait growing each time. If people sign in with a password instead, check Windows limits wrong guesses — in a Terminal opened as administrator, net accounts shows the lockout threshold, and net accounts /lockoutthreshold:10 sets it to 10.

The exception is a PC joined to your Microsoft 365 organisation (Microsoft Entra ID), where signing in to Windows also signs people in to Outlook, Teams and OneDrive with no further prompt. Then the Windows sign-in is also the work login, and the requirements say the full password rules apply to it (A5.10, A7.10, A7.11). Microsoft describes Windows Hello for Business as two-factor authentication — the PC’s own key plus the PIN or biometric — and multi-factor authentication is one of the accepted routes. If that is your set-up, describe it plainly in your answers and check with your certification body how they want it recorded; that is their judgement to make. The device-locking guide covers the unlock rules for every kind of device.

6. AutoPlay off (A5.8)

Settings → Bluetooth & devices → AutoPlay: turn off “Use AutoPlay for all media and devices”, or set each option to “Ask me every time” — the question set accepts a prompt. This stops a USB stick or downloaded file running software by itself.

7. Remove what nobody uses (A5.1, A5.2)

Settings → Apps → Installed apps: uninstall trial software, old utilities and anything nobody recognises. Settings → Accounts → Other users: remove accounts for people who have left or that nobody signs in to. Five minutes per PC, and it shortens your free-text answers.

What Windows 11 doesn’t need for Cyber Essentials

Disk encryption (BitLocker) is good practice and worth switching on, but it isn’t a Cyber Essentials requirement. Nor is a paid antivirus, or device-management software if you can meet the rules through settings and habits. And Microsoft 365 is assessed separately from the PC: MFA for every user and separate admin accounts are in the Microsoft 365 guide. An office with Macs as well answers the same questions — the Mac guide has the menu names.