# Microsoft Extends Windows 10 Security Support

Microsoft’s paid Extended Security Updates (ESU) program provides critical and important security updates for physical Windows 10 version 22H2 devices after Windows 10 support ended on October 14, 2025. For contractors and other organizations handling information subject to CMMC Level 2, ESU may support endpoint lifecycle planning during a transition, but ESU enrollment alone does not establish CMMC compliance. Organizations should confirm its applicability with their security team and assessor while planning migration to a supported platform.

- Microsoft’s enrollment instructions apply to physical Windows 10 version 22H2 devices; ESU is a paid program.
- Contractors handling CMMC Level 2 information should assess whether ESU is appropriate for their endpoint plans and validate that decision with their security team and assessor.
- Organizations using ESU should treat it as a transitional support option, not a substitute for planning migration to a supported operating system.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** October 14, 2026

### Vendors
- Microsoft (ESU licensing provider)

### Key Quotes
> The device needs access to the internet and to Microsoft Activation Servers.
> — Original poster (reproduced Microsoft documentation)

### Sources
- [Win10 and CMMC L2](https://www.reddit.com/r/CMMC/comments/1x5xu58/win10_and_cmmc_l2) - reddit-cmmc