Why one unsupported laptop can stop you passing

Most small businesses have one: the laptop in the corner that still works, runs an old version of its operating system and is used for just one job. This article explains why a single unsupported device can be enough to stand between you and a Cyber Essentials pass, and what you can do about it.

What the requirement says

Under the security update management control, the NCSC requirements say all software on in-scope devices must be licensed and supported. It must also be removed from devices when it becomes unsupported, or taken out of scope by using a defined sub-set that prevents all traffic to or from the internet.

That is the whole of the choice the document offers: remove the unsupported software, or isolate it completely. There is no option to keep using it as normal and explain why.

What supported means

The document is specific. Licensed and supported software is software you have a legal right to use and that a vendor has committed to support by providing regular vulnerability fixes. The vendor must provide the future date when they will stop providing those fixes.

Notice what that excludes. Software with no known end date is not clearly supported, and neither is software whose fixes have stopped. The vendor does not need to have created the software originally, but they must be able to change it to produce fixes.

The definition of software is broad. It includes operating systems, applications, extensions, interpreters, scripts, libraries, network software and the firmware of firewalls and routers. So the unsupported item might be an operating system, an old browser, or the router at the back of the office.

Why one device is enough

The rule applies to every in-scope device and every piece of software on it. A scope is made up of all of those devices, so one that fails the requirement is a gap in the whole.

The risk is easy to understand. The requirements explain that vendors fix flaws in products they still support, and that attackers move quickly once a flaw is known. If a vendor has stopped supporting a product, new flaws stay unfixed. That is why the unsupported laptop matters more than the many up-to-date ones around it: it is the one that cannot be fixed.

Cyber Essentials Plus shows how strict the scheme is about single gaps. The test specification says any single fail in any sub-test means the whole assessment is a fail, and its patching test scans sampled devices for serious vulnerabilities whose fixes were released more than 14 days earlier.

Your options

1. Replace or upgrade it

The simplest answer is usually to move to a version the vendor still supports. If the hardware cannot run a supported system, replacing it may cost less than the time spent working around it.

2. Remove the software

If only one application is unsupported, the requirements say to remove it from the device when it becomes unsupported. Check whether a supported alternative can do the same job.

3. Take it out of scope with a sub-set

The document allows a defined sub-set that prevents all traffic to or from the internet. The requirements describe a sub-set as part of the organisation whose network is separated from the rest by a firewall or VLAN. This might suit a machine that runs a specialist tool and does not need the internet at all. The word that matters is all: the sub-set must prevent every connection to and from the internet, and the scope boundary must be clearly defined. You must agree the scope with your certification body before assessment begins. The Plus specification says assessors verify by technical means that sub-sets have been segregated effectively.

4. Retire it

If nobody really needs the device, switch it off, wipe it and remove it from your accounts.

What about personal devices?

Personal devices that access your organisational data or services are in scope. That means a staff member’s old phone or laptop that opens work email can raise the same issue. A clear policy about which devices may access company data, and a way to check them, helps here. Our article on what is in scope explains the details.

Finding unsupported software before the assessor does

• Make a list of every device that touches business data.
• For each, note the operating system version and the main applications.
• Look up the vendor’s published end of support date for each one. The requirements say the vendor must give a future date, so you should be able to find it.
• Mark anything past its date, or close to it, for replacement.
• Include routers and firewalls, and remember that the firmware is software too.

The NCSC’s resources include a free Readiness Tool and a free question set booklet, both of which can help you spot gaps early.

In short

Cyber Essentials requires all in-scope software to be licensed and supported, and removed once it is unsupported, unless it sits in a sub-set that blocks all internet traffic. One unsupported device is enough to create a gap, because it cannot receive the fixes the scheme relies on. Find it early, then replace it, remove the software or isolate it properly.

How Vigil CE helps

Vigil CE keeps one list of your devices and the software on them, with support dates noted, so an ageing laptop shows up months before your assessment rather than during it. You can plan replacements calmly and keep a record of what you decided.