Summary
Note: This alert does not apply to federally certified voting systems running Windows 7. Microsoft will continue to provide free security updates for these systems until the 2020 elections. See Microsoft’s article, Extending free Windows 7 security updates to voting systemsfor more information.
On January 14, 2020, Microsoft will end extended support for its Windows 7 and Windows Server 2008 R2 operating systems.[1] After this date, these products will no longer benefit from free technical support, software and security updates.
Organizations with regulatory obligations may find themselves unable to meet compliance requirements when running Windows 7 and Windows Server 2008 R2.
Technical details
All software products have a life cycle. “End of Support” refers to the date when the software publisher will no longer provide automatic patches, updates, or online technical support. [2]
For more information about end of support for Microsoft products, see the Microsoft End of Support FAQ.
Systems running Windows 7 and Windows Server 2008 R2 will continue to operate at their current capacity even after support ends on January 14, 2020. However, using unsupported software can increase the risk of malware and other security threats. Mission and business functions supported by systems running Windows 7 and Windows Server 2008 R2 could be negatively impacted by unpatched vulnerabilities and software bugs. These negative consequences could include loss of confidentiality, integrity and availability of data, system resources and business assets.
Mitigations
The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and organizations to:
- Upgrade to a newer operating system.
- Identify affected devices to determine the extent of the problem and assess the risk of not upgrading.
- Establish and execute a systematic migration plan to currently supported operating systems or use a cloud-based service.
- Contact the operating system vendor to explore options for paid maintenance, if you are unable to upgrade.
References
Revisions
October 17, 2019: Initial version|October 18, 2019: Note added
