On October 14, 2025, Microsoft ended support for Windows 10. That means no more free security updates or fixes. If any device on your network still runs Windows 10, many compliance programs may treat that as a security and documentation gap unless you have documented compensating controls or have enrolled in a time-limited ESU program. Here's what that means for Knoxville IT support planning — and how Crestline Technologies can help.
Why this matters
Unsupported operating systems quickly become the easiest foothold for attackers. For regulated businesses — medical practices, payment environments, manufacturers with government contracts — running an unsupported OS typically violates requirements to keep systems patched and supported.
In plain terms: leaving Windows 10 in production after EOS creates audit exposure and real security risk.
Compliance snapshot
| Framework | What Auditors Expect | Risk |
|---|---|---|
| HIPAA | HHS OCR guidance flags legacy/unsupported systems as high-risk. Devices handling ePHI must be removed or fully isolated with documented compensating controls and a retirement plan. | High |
| PCI DSS | Systems must be protected against known vulnerabilities. Unsupported OS cannot meet this without ESU — generally non-compliant unless properly segmented and remediated. | High |
| NIST 800-53 / CMMC | Control SA-22 requires replacing unsupported components or formally justifying their temporary use with safeguards and timelines. Auditors look for asset inventories, exceptions, risk acceptance, and retirement dates. | High |
Your 30-day action plan
Find & Freeze Risk
Run a full asset inventory to identify all Windows 10 devices — including kiosks, labs, test benches, and forgotten laptops. Isolate high-risk devices from sensitive VLANs. If a device must stay online briefly, enroll it in ESU and document a retirement date.
Plan Upgrades & Replacements
Check upgrade paths to Windows 11 for compatible hardware. For older machines, plan a hardware refresh or move workloads to Windows 365/Azure Virtual Desktop. Prioritize systems touching PHI, PCI, or CUI first.
Execute & Prove
Perform in-place upgrades or device swaps. Capture before/after screenshots and logs. Decommission or re-image retired Windows 10 devices and update your inventory and network diagrams.
Close the Loop
Remove temporary firewall rules. Validate backups and EDR coverage on new endpoints. Update policies: Supported Software Standard, patch SLAs, exception handling, and quarterly access reviews.
How Crestline Technologies helps — fast
- Remote Monitoring & Management (RMM): Real-time detection of Windows versions, ESU enrollment status, missing patches, and unsupported software. Auto-tag and alert Windows 10 nodes the moment they appear.
- Asset Intelligence: Clean, exportable inventory with models, ages, warranties, network location, and business owner — mapped to risk tiers (PHI/PCI/CUI).
- Automated Remediation: Push upgrades where compatible, schedule device swaps, lock down legacy endpoints with local firewall, app control, and least-privilege settings.
- Quarterly Business Review (QBR): Plain-English brief showing progress — Windows 10 devices remediated, remaining exceptions and dates, security score movement, and next-step budget recommendations.
FAQ
Is ESU enough to keep me compliant?
ESU provides critical/important security updates for a limited time. It can support a documented temporary exception, but most frameworks still expect a retirement plan, segmentation, and evidence you're actively migrating.
What if a machine can't be upgraded?
Treat it as a legacy/exception system: segment it, limit accounts/services, monitor aggressively, restrict data flows, and set a hard retirement date. Track the exception in your risk register and review it quarterly — or sooner.
Sources
- Microsoft: Windows 10 support ends on Oct 14, 2025
- Microsoft Learn: Windows 10 lifecycle (22H2 final)
- HHS/OCR: Patch Management & Unsupported Software
- NIST SP 800-53 r5: SA-22 Unsupported System Components
- PCI DSS v4.0: Requirement 6.x (patching timelines)
- Microsoft: Extended Security Updates (Windows 10)
Our team can run a same-day discovery and give you a punch-list to regain compliance. We'll identify every Windows 10 device, assess your exposure, and build a remediation plan that fits your timeline, budget, and cybersecurity requirements.
Schedule a Free Assessment