Can I still pass with Windows 10 in 2026?

Windows 10 reached end of mainstream support on 14 October 2025. Devices on Windows 10 must either be upgraded to Windows 11, enrolled in Microsoft ESU, or scoped out / isolated.

What about an old line-of-business app that the vendor no longer updates?

If it is in scope and on a network with internet access, it fails the assessment. Options: replace, scope it out, or isolate it on a fully segregated network with no internet.

Does ESU count as supported?

Yes. While Microsoft ESU is in place and current, the OS is considered supported for Cyber Essentials purposes.

Does this apply to mobile devices?

Yes. iOS and Android devices on versions no longer receiving security updates are unsupported and must be upgraded or removed from scope.

How does the assessor check?

For CE the assessor relies on your declaration plus evidence (asset list, OS versions). For CE Plus, the authenticated device scan reveals OS and patch level directly.

Unsupported Software and Cyber Essentials | Compliance Guide

What "supported" means

The vendor must currently issue security patches for the version you are running. Once a version is end-of-life (EOL), it stops receiving fixes and is automatically out of compliance.

Still running Windows 10? Read Windows 10 and Cyber Essentials: ESU, upgrades and scope for what ESU means for your submission.

Supported-software check: a quick decision table

Work through each in-scope operating system, application, firmware and browser:

Question	If yes	If no
Does the vendor still support this version?	Go to the next question	Upgrade, replace, remove, or isolate it out of scope
Is the vendor still releasing security fixes for it (including any paid ESU you hold)?	Go to the next question	Treat as unsupported: upgrade, replace, remove or segregate
Are CE-required vulnerability fixes applied within 14 days of release?	Compliant on updates	Fix your patching process before you submit
Is any remaining unsupported software removed, replaced or segregated with no internet access?	Can stay outside the assessed scope (document it)	It is in scope and will fail

The 14-day rule, precisely: under the NCSC requirements (v3.3), updates must be applied within 14 days of release where they fix vulnerabilities the vendor describes as critical or high risk, rated CVSS v3 7 or above, or where the vendor gives no severity level. Applying every released update within 14 days is recommended, not mandatory. Automatic updates are the simplest way to meet it.

Common unsupported software in 2026

Windows Server 2012 / 2012 R2 (EOL October 2023)
Windows 10 22H2 (EOL October 2025 unless on ESU)
Windows 8 / 8.1 (EOL January 2023)
macOS versions older than the current N-2 (Apple supports the latest 3)
Office 2016 (EOL October 2025)
Old Java runtimes, end-of-life browsers, abandoned line-of-business apps

Your three options

1. Upgrade

The simplest path. Plan it before submission.

2. Scope out

Move the unsupported asset out of scope by removing it from any network that has internet access and confirming it cannot reach in-scope users. Document the boundary clearly.

3. Isolate on a segregated sub-set

Place the asset on a separate VLAN with no inbound or outbound internet access and no path to in-scope devices. Document the segmentation. This is the only way to keep an unsupported asset in the assessable estate without failing.

What does not count as a workaround

"We have anti-virus on it" – not sufficient
"We don't use it much" – usage frequency is irrelevant
"It's behind a firewall" – it must be properly segmented, not just firewalled

Extended Security Updates (ESU)

Microsoft ESU programmes (Windows 10 ESU, Windows Server ESU) extend the supported life of an OS for an annual fee. While ESU is in place, the OS is considered supported for Cyber Essentials. For Windows 10 specifically, see Windows 10 and Cyber Essentials.