Section 6: Security update management
If any device in scope runs an unsupported operating system you will not be awarded certification.
Every operating system in scope must receive regular security fixes from its maker. That includes:
- Windows, macOS, ChromeOS, Linux, iOS, iPadOS and Android on school and staff devices
- the firmware on your firewall and router, which counts as an operating system
The maker must have published a future date when it will stop providing fixes (NCSC Requirements v3.3, page 4).
The IASME booklet lists these as out-of-support examples:
- Windows 7
- XP
- Vista and Server 2003
- macOS Ventura
- iOS 15
- Android 12
- Ubuntu 17.10
Windows support end dates
Check the exact edition and version of Windows, because support end dates differ. Windows 10 is only acceptable if you are enrolled in Microsoft's Extended Security Updates.
These dates are from secondary sources citing Microsoft; verify against Microsoft's lifecycle pages and IASME's Operating System Support page before use (checked 27 October 2026).
- Windows 11 24H2 Home and Pro - support ended 13 October 2026 - a school using this would answer No to A6.1 and fail the assessment
- Windows 11 24H2 Education and Enterprise - supported to 12 October 2027
- Windows 11 23H2 Education and Enterprise: support ends 10 November 2026
- Windows 10: support ended 14 October 2025 -extended Security Updates year 1 ended 13 October 2026, so year 2 must be in place
NCSC counts operating systems, applications, extensions, scripts, libraries and firewall and router firmware as software (Requirements v3.3, page 5).
All software on in-scope devices must be licensed and supported by a supplier that provides regular security fixes. This includes:
- office software
- MIS and finance software
- browsers
- plugins
- PDF readers
- frameworks
- extensions
Unsupported software must be removed from your devices. Free and open-source software is fine if you follow its licence terms and it still receives fixes.
6.2.1 Please list your internet browsers with version.
List every internet browser (with the version number) that is installed on in-scope devices. Include browsers on staff devices, pupil devices, Chromebooks, phones and tablets. Make sure the supplier is still providing security fixes for each version.
The assessor will check they are still supported.
6.2.2 Please list your malware protection software with version.
List the anti-malware or anti-virus software on your devices, with the version, so the assessor can check it is supported.
Microsoft Defender is accepted.
If some devices, such as iPads or Chromebooks, rely on approved apps from an app store instead of anti-malware software, say so here and explain in A8.1 (NCSC Requirements v3.3, pages 23 to 24).
6.2.3 Please list your email applications with version.
List the email applications installed on end user devices and servers, with the version. If staff only use email in a web browser, say so and name the service.
If you run your email server yourself, it must be a version the supplier still supports.
Cloud email services are also listed in 2.9.
6.2.4 Please list all office and productivity applications with version.
List every office and productivity application used to create school data, including cloud services you sign in to such as Microsoft 365 and Google Workspace. Include MIS and finance applications installed on school devices.
Give versions for installed applications so the assessor can check they are still supported.
NCSC requires all software in scope to be licensed and supported (Requirements v3.3, page 17). Answer Yes if any software or cloud service in scope is unlicensed or unsupported.
All software must be licensed. Free and open-source software is fine if you follow its licence.
Some operating systems, firmware and applications stop receiving security updates if the annual licence or support subscription is not renewed. Check your:
- firewall support subscription
- virtualisation licences
- annual software support
Ask your IT provider if you are unsure.
6.3.1 Please list the unsupported or unlicensed software.
If you answered Yes to 6.3, list each piece of unsupported or unlicensed software or cloud service, why it is unsupported, and what you plan to do about it.
If there are none, write No unsupported or unlicensed software or cloud services.
If you are keeping unsupported software, also see 6.7.
Answering No means you will not be awarded certification.
All high-risk and critical security updates for operating systems and for firewall and router firmware must be installed within 14 days of release, with no exceptions. This covers updates:
- the vendor calls "critical or high-risk"
- that fix vulnerabilities with a CVSS v3 base score of 7 or more
- where the vendor gives no severity
Feature updates are not required. If a vendor releases one update covering several issues and any are critical or high-risk, install it within 14 days (NCSC Requirements v3.3, pages 17 to 18). Devices kept in trolleys or cupboards, or switched off during school holidays, still need a plan to get updates within 14 days.
6.4.1 Are all OS updates applied by enabling auto-updates?
NCSC requires automatic updates to be enabled where possible (Requirements v3.3, page 17). Automatic updates should be switched on wherever the device allows it.
Answer No if any devices are updated manually or through a managed system, and explain how in 6.4.2.
6.4.2 If auto-updates not used - how are OS and firmware updates applied within 14 days?
If you answered No to 6.4.1, explain how high-risk and critical operating system and firmware updates are installed within 14 days without automatic updates, for example on servers, critical systems, or firewall and router firmware. Make sure your process covers every operating system in scope (NCSC Requirements v3.3, page 17).
State if you only use automatic updates.
Answering No means you will not be awarded certification (NCSC Requirements v3.3, pages 17 to 18).
All high-risk and critical security updates for applications, including associated files and extensions, must be installed within 14 days of release, with no exceptions. The same severity rules apply as in 6.4.
Applications include:
- browsers
- office software
- PDF readers
- MIS and finance clients
- teaching software
- plugins
Feature and optional updates are not required.
6.5.1 Are all application updates applied by enabling auto-updates?
NCSC requires automatic updates to be enabled where possible (Requirements v3.3, page 17). Automatic updates should be switched on for applications wherever the software allows it.
Answer No if any applications are updated manually or through a managed process and explain how in 6.5.2.
6.5.2 If auto-updates not used - how are software updates applied within 14 days?
Only needed if you answered No to 6.5.1. Briefly explain how high-risk and critical application updates are installed within 14 days when you do not use automatic updates, for example for MIS, finance or teaching software you test before deploying.
State if you only use automatic updates (NCSC Requirements v3.3, page 17).
NCSC says unsupported software must be removed, or removed from scope using a sub-set that blocks all traffic to and from the internet (Requirements v3.3, page 17).
Remove software that is no longer supported by its maker and no longer receives security fixes, such as old browsers, operating systems and applications. If you cannot remove it, upgrade it, or place it on a separate network with no internet access (see 6.7).
If you still need to use software that is no longer supported, for example on specialist equipment, it must be:
- moved to its own network with no internet access
- separated from the rest of your network by a firewall or VLAN
If it can still reach the internet, you cannot certify the whole organisation and must choose Partial Organisation in 2.1.
Describe the separated network in 2.2.1 and 2.2.2.
State if you have no unsupported software (NCSC Requirements v3.3, page 17).
Did you find what you needed?
Fill in our 3 question survey and let us know if you need more help.