Share This Article
Many small and medium-sized businesses still rely on Windows 7, often because of legacy software, specialist hardware, or operational constraints that make upgrading difficult.
Although Windows 7 reached end of support in January 2020, using it does not automatically prevent you from achieving Cyber Essentials certification.
This guide explains the challenges Windows 7 presents and how your organisation can still meet the five Cyber Essentials technical controls while operating an unsupported OS.
Windows 7 is no longer supported by Microsoft, which means:
Newly discovered vulnerabilities remain unpatched.
Lacks modern protections such as advanced credential isolation and secure boot.
Many modern security tools no longer support Windows 7.
Makes monitoring and incident detection more difficult.
Despite these issues, Cyber Essentials certification is still achievable with the right controls, documentation, and risk mitigation.
To pass Cyber Essentials, your organisation must demonstrate compliance with:
Below, we break down how to meet each requirement when Windows 7 is part of your environment.
Start by documenting:
If a Windows 7 system cannot meet certain controls, you may classify it as a legacy system and place it out of scope but only if it is properly isolated from the rest of the network.
To ensure you adhere to the cyber essentials changes set for April 2026 you must now list all areas you are excluding and justify these exclusions in order to pass Cyber Essentials.
To reduce risk:
Segmentation prevents attackers from moving laterally if a legacy system is compromised.
Even though Windows 7 is out of support:
Where patches are unavailable, compensating controls become essential.
For Windows 7 systems that cannot be fully secured:
Implement additional safeguards such as:
These measures help offset the inherent risks of running an unsupported OS.
All traffic to and from Windows 7 systems should pass through a properly configured firewall with:
This ensures legacy systems cannot communicate freely with the wider network.
Calculate The Cost of your Cyber Essentials Accreditiation
Windows 7 does not support modern identity protections like MFA natively, but you can still:
Segmentation also helps ensure legacy systems are not exposed to unnecessary users.
Modern antivirus tools may not support Windows 7, but you still have options:
Use:
Ensure definitions are updated and that scanning is enforced.
Windows 7 has limited native logging, but you can still:
Where host-level monitoring is limited, network monitoring becomes critical.
Your Cyber Essentials assessor will expect clear evidence. Document:
Thorough documentation demonstrates that risks are understood and managed.
While Windows 7 can be used in the short term, it should not be part of your long-term IT strategy.
Include in your Cyber Essentials submission:
This shows assessors that you are committed to improving your security posture.
Although Windows 7 is unsupported, your organisation can still achieve Cyber Essentials certification by:
With the right approach, Windows 7 does not have to be a barrier to certification.
Want to discuss how Syn-Star can support your business with achieving cyber essentials?
Use our handy calender to book a quick chat with one of our exports.
Yes, but only if Windows 7 devices are fully supported and securely configured.
Since Windows 7 is no longer supported by Microsoft, you must have Extended Security Updates (ESU) in place or equivalent third‑party support.
Without this, Windows 7 is considered an unsupported operating system, which is not permitted under Cyber Essentials unless strictly isolated.
If the device is unsupported (no ESU or vendor support), then yes. Unsupported systems must be:
Completely isolated from the internet
Segmented from the main business network
Protected with strong compensating controls
If Windows 7 is still receiving security updates through ESU, isolation is not required but strong security controls are still expected.
Not immediately, but it’s strongly recommended. Cyber Essentials requires all operating systems to be:
Supported
Patched
Securely configured
Since Windows 7 is end‑of‑life, relying on it long‑term increases your risk and may complicate future certifications.
Some security vendors continue to support Windows 7, but compatibility varies. You’ll need to:
Confirm your antivirus still provides updates
Ensure real‑time protection is active
Verify the product meets Cyber Essentials requirements
If your security tools no longer support Windows 7, the system becomes non‑compliant.
Examples include:
Network isolation
Application whitelisting
Strict access controls
Virtualisation or sandboxing
Blocking all inbound and outbound internet traffic
These controls must be documented and justified during assessment.
Giles Cleverley founded Syn-Star in 2002 shortly after graduating from Portsmouth university with an honours degree in Business & Economics.
His extensive knowledge and experience in IT strategy and business technology solutions. He is passionate about driving innovation and delivering tailored IT support that helps UK small and medium size businesses thrive. Under his leadership, Syn-Star continues to provide cutting-edge managed IT services designed to meet the evolving needs of modern organisations.
Learn more:
Share this article
Sign up to our newsletter
Partnerships
Team Productivity:
You and your team are able to see where they are using their time and how productive they are actually being. Also they are able to clock in and out, so really good for flexi-working.
Team Monitoring:
If you would like to know what your team is doing and how productive they are being, we are able to monitor them and create screenshots of what they are working on. This can be run in normal or stealth mode.
Book a FREE fact finding session to discuss the different options.
We proactively seek opportunities to support good causes for our community.
From sponsoring local community football teams, to engaging with charity fundraiser days, we believe it’s important to continually strive to do good for the better of others.
We have members who volunteer with youth organisations, are engaged with the Round Table, run marathons and volunteer at events where we may be needed. Every charity receives a discounted IT and Telecoms service too.
Protecting your digital data is crucial for every business and this can start with the industry-leading security we offer. The Syn-Star specialists can help with identifying any vulnerabilities within your IT systems and act accordingly to ensure cyber-attacks and data breaches are mitigated.
Your business will never fall behind with its technology when you work with Syn-Star.
We understand IT and Telecoms for your business is an investment, but it’s important to use the best resources available to enable the growth of your business. Our IT Consultancy and Virtual IT Director Services are available to support you with how you use your business technology for years to come.
Syn-Star can conduct quick and easy phishing exercises to identify people within your team who need to improve on their knowledge around fraudulent emails and how they can be alerted to these threats.
At Syn-Star, our experts can proactively work to understand exactly what software you need to support with the business operations. Whether you need a listening ear on what software to choose, or would like to seek some specialist knowledge, we’re here to help where we can.
At Syn-Star, we keep Telecoms simple. There’s so much available to help UK companies with their communications. VoIP systems, fixed landline, cloud phone systems, SIP trunking and more. Contact us for further details.
Desk phones, cordless phones or conference phones, Syn-Star can provide you with whatever you need.
From conference calling facilities to the headsets which work best for your team, we’re able to provide all the equipment you need and complete any telecoms job from start to finish.
There is no need to be in the office to make and receive phone calls from your company’s number. Our market-leading Telecoms platform gives you the flexibility of desk phones, soft phones and mobile apps as standard.
Whether your team works remotely, or perhaps staff are on a business trip anywhere in the world, calls can still be made, and people are reachable via phone wherever they go.
With a range of products, our team can support you by installing exactly what you need for internet connectivity. We work with the very best products to provide speedy bandwidths which play a part in the increased productivity of your team.
