Cyber Essentials with legacy software: a UK survival guide
Cyber Essentials, the NCSC-backed certification run by IASME, requires every piece of in-scope software to be licensed and supported, with high and critical patches applied within 14 days. A VB6, DataFlex or DOS-era system cannot meet that test, and neither can the Windows 7 or Server 2012 machine it often runs on. That leaves three honest options: remove the software, segregate it on a network segment with no internet access and document that for the assessor, or replace it. Segregation buys planning time; only replacement ends the annual argument.
You need Cyber Essentials because customers ask for it and much of the public sector requires it. Your twenty-year-old system is exactly the kind of thing the scheme exists to flag. This is the survival guide for holding both facts at once, without panic and without pretending.
The answer in one paragraph
Cyber Essentials requires all software in scope to be licensed and supported, with high and critical security updates applied within 14 days of release. Software the vendor no longer supports must be removed from in-scope devices, or moved out of scope by segregation: a separate network segment with no internet access, documented so the assessor can see the boundary. A VB6, DataFlex or DOS-era estate cannot be patched into compliance because there are no patches, and the operating systems such systems tend to sit on, Windows 7 and Server 2012 among them, are out of support too. That leaves three honest options: remove it, segregate it, or replace it. Segregation is legitimate and buys planning time; it is containment, not a fix.
What the scheme actually is
Cyber Essentials is the UK government’s baseline cyber security certification, developed by the NCSC and run on its behalf by IASME. It is annual: you certify against the current requirements, and twelve months later you answer for your estate again.
The technical content is five control themes: firewalls, secure configuration, access control, malware protection, and security update management. Four of the five are achievable on almost any estate with some discipline. The fifth is where a legacy system meets the scheme head on, because it asks a question your system cannot answer.
There are two levels. Cyber Essentials itself is a self-assessment: your organisation answers a questionnaire and makes a formal declaration that the answers are true. Cyber Essentials Plus covers the same controls and adds an independent technical audit, in which an assessor verifies rather than takes your word.
Neither level is as optional as people hope. Many public-sector contracts require certification outright, and customer and insurer questionnaires increasingly ask for it. For a fair share of the businesses we talk to, the trigger for the whole legacy conversation was a tender document with a Cyber Essentials box on it.
The rule that bites
At the centre of the security update management theme sits a plain requirement: software in scope must be licensed and supported, and high or critical updates must be applied within 14 days of release. Unsupported software must be removed, or moved out of scope by segregation.
Notice what that means for a legacy estate. The problem is not that patching a VB6 or DataFlex runtime within 14 days is difficult. It is that no patches exist to apply, and none are coming; the vendor stopped issuing them years or decades ago. There is no cadence to improve and no process to tighten. The requirement is binary, and your system is on the wrong side of it.
The operating system underneath counts in exactly the same way. Windows 7 left support in January 2020. Windows Server 2012 and 2012 R2 left extended support in October 2023. Windows 10 followed in October 2025. A legacy application on a legacy Windows is not one finding but two, stacked on the same box.
The three honest options
| Option | What it involves | Where it leaves you |
|---|---|---|
| Remove | Decommission the software and whatever it runs on | Compliant immediately. Only available if the system was not load-bearing, which is rarely why anyone is reading this |
| Segregate | Move the system to a segregated network segment, typically a VLAN, with no internet access at all, and document the boundary for the assessor | Certifiable with the system still alive. The software is unchanged, the hardware still ages, and the daily friction of an isolated system begins |
| Replace | Rebuild on a supported stack, with the old system running in parallel until cutover | The fix. Costs real money once, then the question never appears on an assessment again |
Removal is honest and rare. Replacement is the exit. Segregation deserves a section of its own, because it is the option most legacy owners reach for first and it is misunderstood in both directions.
Segregation: legitimate, useful, not a fix
Moving a legacy system out of scope is not a dodge; it is what the scheme explicitly provides for. Done properly it means a network segment with no internet traffic in or out, and documentation an assessor can follow: what lives inside, where the boundary sits, and how the rest of the network is kept apart from it.
Be equally honest about the price. A system with no internet access cannot email an invoice, reach a courier API or feed the accounts package, so people become the integration layer at precisely the moment the business wants fewer manual steps. And nothing inside the segment has improved. The software is still unsupported, the elderly machine it depends on is still elderly, and the pool of people who can change it is still shrinking.
Treated as scaffolding, segregation is genuinely valuable: it takes the certification pressure off while a replacement is specified, built and proven in parallel. Treated as a destination, it leaves every underlying risk in place indefinitely. We recommend it often, and always with an end date attached.
Why “the assessor did not notice” is not a strategy
Every year someone concludes that the questionnaire cannot see their DOS box. Two problems with that.
First, self-assessment is not a test you might luck through; it is a declaration your organisation signs. A certificate obtained on a false declaration is worth less than no certificate at the moment it matters most: after an incident, when the insurer and the customer both re-read what you told them.
Second, Cyber Essentials Plus exists precisely to verify. It is increasingly what larger customers and public frameworks ask for, and its audit will surface the unsupported estate a questionnaire answer glossed over. The distance between what you declared and what the assessor finds is not a comfortable place to stand.
The questionnaire was not written with software older than the assessor in mind, but that is exactly what it catches.
The exit is the real fix
Certification is annual, so this collision is annual too. The calm sequence: map what is actually unsupported on your network, applications and operating systems both; segregate properly and document it, so the current certification cycle is passed honestly; and start the replacement in parallel, so a future questionnaire gets a different answer.
That replacement work is what we do: end-of-life systems rebuilt as modern web applications, with the old system live until cutover, platform by platform under Legacy Rescue. VB6 owners should read the VB6 risks and exit paths note; DataFlex owners should start with Is DataFlex end of life?. And the free Legacy Risk Audit is a 30-minute call producing a one-page written risk summary, which is also exactly the document a certification plan needs.