Cyber Essentials and unsupported software

The NCSC's Cyber Essentials Requirements for IT Infrastructure, version 3.3 (April 2026), says that all software on in-scope devices must:

• be licensed and supported;
• be removed from devices when it becomes unsupported, or removed from scope by using a defined sub-set that prevents all traffic to or from the internet;
• have automatic updates enabled where possible;
• be updated within 14 days of release where the update fixes vulnerabilities the vendor calls critical or high risk, or with a CVSS v3 base score of 7 or above, or where the vendor gives no severity details.

The scheme defines licensed and supported software as software you have a legal right to use and that a vendor has committed to support with regular vulnerability fixes, with a published date when those fixes will stop.

• Devices include servers, physical or virtual. The requirements apply to anything that can accept connections from, or connect out to, the internet, which covers almost every business server.
• Software includes more than the operating system. The NCSC defines it as operating systems, commercial off-the-shelf applications, extensions, interpreters, scripts, libraries, network software, and firewall and router firmware. A database server such as SQL Server under your accounts package is an off-the-shelf application on the server.
• Cloud services cannot be excluded from scope in v3.3. For a hosted virtual server (infrastructure as a service), the requirements say security update management is typically shared between you and the provider. Where the provider implements a control for you, you must make sure it has a contractual commitment to do so (contract clauses, or documents the contract refers to, such as security statements). Check what your provider's contract actually says.

Moving a server off unsupported software is half the job. The same requirements cover how people sign in to it, which matters most for a Remote Desktop server your team reaches from home.

• Cloud services must always use MFA. Version 3.3 says to implement multi-factor authentication where it is available, and that authentication to cloud services must always use it. It also says MFA should always be used for administrative accounts and for accounts that can be reached from the internet, which includes Remote Desktop to a hosted server.
• Passwords need protection against guessing. Where accounts use passwords, v3.3 says you should protect them with at least one of: multi-factor authentication, throttling to no more than 10 guesses in 5 minutes, or locking after no more than 10 failed attempts.
• Firewall admin pages stay off the internet. The administrative interface of a firewall must not be reachable from the internet unless there is a clear, documented business need and it is protected by MFA, or by an IP allow list combined with properly managed passwords.
• Your IT provider's access is in scope. Accounts your organisation owns stay in scope when a supplier or managed service provider uses them. If someone else administers your servers remotely, you must be able to confirm the controls are met and show it in your assessment answers.

Your certificate is assessed at a point in time and has to be renewed each year. If your renewal falls after 12 January 2027, plan the Windows Server 2016 servers now.

1. 01

   Replace or upgrade

   Move the workload to a supported release, either on your own hardware or with a provider. This is the only option that lasts. If a provider patches for you, check that its contract covers the 14-day rule.

2. 02

   Pay for vendor security updates

   Microsoft sells Extended Security Updates for Windows Server 2016 and SQL Server 2016. Whether a server covered by paid ESU counts as supported is a question to put to your certification body before assessment; ESU does provide vendor security fixes with a published end date, but confirm it rather than assume it.

3. 03

   Isolate it

   Put the server in a defined sub-set that prevents all traffic to and from the internet and take it out of scope. Workable for a legacy machine nobody needs from outside, rarely for a live accounts server that people use from home.