Cyber Essentials

Failing Cyber Essentials because of an unsupported bespoke .NET application?

A line-of-business app on an out-of-support .NET version is one of the most common reasons a company fails Cyber Essentials or Cyber Essentials Plus. I upgrade legacy and end-of-life .NET applications to a supported version, in stages and without a rewrite, so the application stops being the thing that holds up your assessment.

Why an old .NET app fails the assessment

Cyber Essentials requires that all software in scope is licensed and supported, and that high and critical vulnerabilities are patched within 14 days of a fix being released (a CVSS v3 base score of 7 or above, or a vendor marking the fix "critical" or "high"). The scheme is clear that unsupported software must be removed, or isolated into a segregated part of the network with no internet access.

A bespoke application on .NET Framework, or on .NET 8 or .NET 9 (both out of support from 10 November 2026), no longer receives security patches. That means:

the runtime itself is unsupported software on an in-scope device;
any high or critical vulnerability found from now on stays open, so it can't meet the 14-day patching rule;
old NuGet dependencies the app pulls in may have their own unpatched high or critical issues.

For Cyber Essentials Plus, an assessor checks exactly this: that installed software is supported, and that high and critical patches have been applied in time. An EOL bespoke app fails on both counts. (Requirements per the NCSC's Cyber Essentials: Requirements for IT Infrastructure; confirm the current version applies to your assessment.)

The two ways to fix it

There are only two routes that satisfy the scheme:

Upgrade the application to a supported .NET. Move it to .NET 10 (supported until November 2028), so the runtime is supported again and security patches can be applied. This is usually doable in stages, without a rewrite, while the app stays live.
Segregate it out of scope. Isolate the app on a separate, internet-free part of the network. This keeps your certification but leaves the application frozen and harder to use, so it's rarely the answer for something the business actually runs on.

For most businesses the upgrade is the real fix: it removes the problem rather than hiding it, and leaves the application cheaper and safer to run.

Check your project in two minutes

If you have the application's .csproj or packages.config, the .NET dependency & upgrade analyzer will flag, in your browser, whether its target framework is out of support and which packages are likely to need attention — a quick first read on whether the app is a Cyber Essentials problem. Nothing is uploaded or stored.

How I help

I'm a senior .NET developer who has built ASP.NET since its first release and migrates business-critical applications to supported .NET in stages, keeping them live. A fixed-price .NET upgrade audit, from £1,500, inventories the application, checks every dependency, breaking change and hosting dependency against a supported target, and gives you a costed, staged plan. You keep the written report whether or not I do the work, and it's exactly the evidence an assessor or your IT provider needs to see a clear remediation path.

Book a .NET upgrade audit

For MSPs, IT providers and assessors

If you look after a client whose bespoke or in-house .NET application is the one thing blocking their Cyber Essentials, I take the application side on directly: the fixed-price upgrade audit above, then a staged migration to a supported .NET, working alongside you so you can get your client over the line. I handle the bespoke-code remediation; you keep the client relationship. Point them at this page, or get in touch with what you're dealing with.