To protect your organisation, you should ensure that all your software is always up to date with the latest security updates. If any of your in-scope devices are using an operating system which is no longer supported (For example Microsoft Windows XP/Vista/2003/Windows 7/Server 2008, MacOS High Sierra, Ubuntu 17.10), and you are not being provided with regular updates from the vendor, then you will not be awarded certification. Mobile phones and tablets are in-scope and must also use an operating system that is still supported by the manufacturer.
