Can I still pass with Windows 10 in 2026?

Windows 10 reached end of mainstream support on 14 October 2025. Devices on Windows 10 must either be upgraded to Windows 11, enrolled in Microsoft ESU, or scoped out / isolated.

What about an old line-of-business app that the vendor no longer updates?

If it is in scope and on a network with internet access, it fails the assessment. Options: replace, scope it out, or isolate it on a fully segregated network with no internet.

Does ESU count as supported?

Yes. While Microsoft ESU is in place and current, the OS is considered supported for Cyber Essentials purposes.

Does this apply to mobile devices?

Yes. iOS and Android devices on versions no longer receiving security updates are unsupported and must be upgraded or removed from scope.

How does the assessor check?

For CE the assessor relies on your declaration plus evidence (asset list, OS versions). For CE Plus, the authenticated device scan reveals OS and patch level directly.

Unsupported Software and Cyber Essentials | Compliance Guide

What "supported" means

The vendor must currently issue security patches for the version you are running. Once a version is end-of-life (EOL), it stops receiving fixes and is automatically out of compliance.

Common unsupported software in 2026

Windows Server 2012 / 2012 R2 (EOL October 2023)
Windows 10 22H2 (EOL October 2025 unless on ESU)
Windows 8 / 8.1 (EOL January 2023)
macOS versions older than the current N-2 (Apple supports the latest 3)
Office 2016 (EOL October 2025)
Old Java runtimes, end-of-life browsers, abandoned line-of-business apps

Your three options

1. Upgrade

The simplest path. Plan it before submission.

2. Scope out

Move the unsupported asset out of scope by removing it from any network that has internet access and confirming it cannot reach in-scope users. Document the boundary clearly.

3. Isolate on a segregated sub-set

Place the asset on a separate VLAN with no inbound or outbound internet access and no path to in-scope devices. Document the segmentation. This is the only way to keep an unsupported asset in the assessable estate without failing.

What does not count as a workaround

"We have anti-virus on it" – not sufficient
"We don't use it much" – usage frequency is irrelevant
"It's behind a firewall" – it must be properly segmented, not just firewalled

Extended Security Updates (ESU)

Microsoft ESU programmes (Windows 10 ESU, Windows Server ESU) extend the supported life of an OS for an annual fee. While ESU is in place, the OS is considered supported for Cyber Essentials.