# Cyber Essentials and unsupported software

> What Cyber Essentials v3.3 says about unsupported software, 14-day patching and MFA, how it hits Windows Server 2016 and SQL Server 2016, and your options.

Source: https://wharfcloud.co.uk/guides/cyber-essentials-unsupported-software · Last updated 21 October 2026 · WharfCloud

Published 21 October 2026. Reading time about 7 minutes.

## Short answer

Cyber Essentials requires all software on in-scope devices, servers included, to be **licensed and supported**, and to be removed or isolated from the internet when it stops being supported. Critical and high-risk security updates must be installed within **14 days** of release. So a server on Windows Server 2016 after 12 January 2027, or on SQL Server 2016 after 14 July 2026, puts certification at risk unless it is replaced, covered by vendor security updates your certification body accepts, or moved into an isolated sub-set with no internet traffic.

## What the requirement says

The NCSC's Cyber Essentials Requirements for IT Infrastructure, version 3.3 (April 2026), says that all software on in-scope devices must:

- be licensed and supported;
- be removed from devices when it becomes unsupported, or removed from scope by using a defined sub-set that prevents all traffic to or from the internet;
- have automatic updates enabled where possible;
- be updated within 14 days of release where the update fixes vulnerabilities the vendor calls critical or high risk, or with a CVSS v3 base score of 7 or above, or where the vendor gives no severity details.

The scheme defines licensed and supported software as software you have a legal right to use and that a vendor has committed to support with regular vulnerability fixes, with a published date when those fixes will stop.

## Servers are in scope, wherever they are

- **Devices include servers, physical or virtual.** The requirements apply to anything that can accept connections from, or connect out to, the internet, which covers almost every business server.
- **Software includes more than the operating system.** The NCSC defines it as operating systems, commercial off-the-shelf applications, extensions, interpreters, scripts, libraries, network software, and firewall and router firmware. A database server such as SQL Server under your accounts package is an off-the-shelf application on the server.
- **Cloud services cannot be excluded from scope** in v3.3. For a hosted virtual server (infrastructure as a service), the requirements say security update management is typically shared between you and the provider. Where the provider implements a control for you, you must make sure it has a contractual commitment to do so (contract clauses, or documents the contract refers to, such as security statements). Check what your provider's contract actually says.

## Remote access and multi-factor authentication

Moving a server off unsupported software is half the job. The same requirements cover how people sign in to it, which matters most for a Remote Desktop server your team reaches from home.

- **Cloud services must always use MFA.** Version 3.3 says to implement multi-factor authentication where it is available, and that authentication to cloud services must always use it. It also says MFA should always be used for administrative accounts and for accounts that can be reached from the internet, which includes Remote Desktop to a hosted server.
- **Passwords need protection against guessing.** Where accounts use passwords, v3.3 says you should protect them with at least one of: multi-factor authentication, throttling to no more than 10 guesses in 5 minutes, or locking after no more than 10 failed attempts.
- **Firewall admin pages stay off the internet.** The administrative interface of a firewall must not be reachable from the internet unless there is a clear, documented business need and it is protected by MFA, or by an IP allow list combined with properly managed passwords.
- **Your IT provider's access is in scope.** Accounts your organisation owns stay in scope when a supplier or managed service provider uses them. If someone else administers your servers remotely, you must be able to confirm the controls are met and show it in your assessment answers.

## Dates that matter for typical small-business servers

Table: End of Microsoft support for common server software

| Software | End of extended support | Status on 21 October 2026 |
| --- | --- | --- |
| Windows Server 2012 and 2012 R2 | 10 October 2023 (paid ESU ended 13 October 2026) | Unsupported |
| SQL Server 2016 | 14 July 2026 | Unsupported without paid ESU |
| Windows Server 2016 | 12 January 2027 | Supported until that date |
| SQL Server 2017 | 12 October 2027 | Supported until that date |
| Windows Server 2019 | 9 January 2029 | Supported until that date |

Your certificate is assessed at a point in time and has to be renewed each year. If your renewal falls after 12 January 2027, plan the Windows Server 2016 servers now.

## Your three options

1. **Replace or upgrade.** Move the workload to a supported release, either on your own hardware or with a provider. This is the only option that lasts. If a provider patches for you, check that its contract covers the 14-day rule.
2. **Pay for vendor security updates.** Microsoft sells Extended Security Updates for Windows Server 2016 and SQL Server 2016. Whether a server covered by paid ESU counts as supported is a question to put to your certification body before assessment; ESU does provide vendor security fixes with a published end date, but confirm it rather than assume it.
3. **Isolate it.** Put the server in a defined sub-set that prevents all traffic to and from the internet and take it out of scope. Workable for a legacy machine nobody needs from outside, rarely for a live accounts server that people use from home.

> **Where we fit** Our [Windows Server 2016 migration plan](https://wharfcloud.co.uk/windows-server-2016-end-of-support) maps up to five servers to a supported destination. A [Managed Windows Server](https://wharfcloud.co.uk/managed-servers/windows) runs a currently supported Windows Server release, and section 12 of our [terms](https://wharfcloud.co.uk/legal/terms#security) commits us in writing to install critical and high-risk security updates within 14 days and to require multi-factor authentication for every Remote Desktop sign-in. Your own applications, devices and user accounts stay your responsibility, so check the whole picture against the requirements before your assessment. Your WharfCloud panel manages your server, so it counts as a cloud service: turn on two-factor sign-in for it in your panel settings.

## Frequently asked questions

### Does Cyber Essentials allow unsupported software?

Not on in-scope devices. Unsupported software must be removed, or the device moved into a defined sub-set with no traffic to or from the internet and taken out of scope.

### Can I keep Windows Server 2016 after 12 January 2027 and still pass?

Not as an ordinary supported server. You would need to replace it, cover it with paid Extended Security Updates and confirm with your certification body that they accept that, or isolate it out of scope.

### What is the 14-day rule?

Updates that fix critical or high-risk vulnerabilities (CVSS v3 score 7 or above, or the vendor's own rating) must be installed within 14 days of release. If the vendor gives no severity details, the 14-day rule applies too.

### Are hosted and cloud servers in scope?

Yes. Version 3.3 says cloud services cannot be excluded from scope. For hosted virtual servers, patching is typically shared between you and the provider. Where the provider does it for you, the NCSC requires a contractual commitment, so check your provider's contract.

### Does Cyber Essentials require MFA for Remote Desktop?

Version 3.3 says MFA should always be used for administrative accounts and accounts that can be reached from the internet, and that authentication to cloud services must always use it. Remote Desktop to a hosted server can be reached from the internet, so a second factor on every sign-in is the straightforward way to meet the requirement.

### Does backing up count towards Cyber Essentials?

Backups are recommended in the requirements but are not one of the technical controls assessed. They still matter: see [Cyber Essentials backup requirements explained](https://wharfcloud.co.uk/guides/cyber-essentials-backup-requirements) and our [backup checklist](https://wharfcloud.co.uk/guides/uk-small-business-backup-checklist).

## Sources

- [NCSC: Cyber Essentials Requirements for IT Infrastructure v3.3 (April 2026), PDF](https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf)
- [NCSC: Cyber Essentials resources](https://www.ncsc.gov.uk/cyberessentials/resources)
- [Microsoft Lifecycle: Windows Server 2016](https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2016)
- [Microsoft Lifecycle: SQL Server 2016](https://learn.microsoft.com/en-us/lifecycle/products/sql-server-2016)
- [Microsoft Learn: Lifecycle FAQ, Extended Security Updates](https://learn.microsoft.com/en-us/lifecycle/faq/extended-security-updates)

---

WharfCloud is a trading name of Sunucu Internet Services Consultancy Ltd, registered in England and Wales, company number 12963678. Not VAT registered.
Support: engineers Monday to Friday, 08:00 to 18:00 UK time. Critical incidents: A person responds to critical incidents within 1 hour (Every day, 07:00 to 23:00 UK time). Automated monitoring and automated recovery overnight and at weekends.
Contact: hello@wharfcloud.co.uk · https://wharfcloud.co.uk/contact