Key takeaways
- Office 2021 reaches end of life on October 13, 2026, and Microsoft offers no extended security updates for it.
- Commercial Windows 10 ESU is sold by the year: $61 per device for year one and $122 for year two, for a maximum of three years.
- ESU is cumulative, so a firm buying year two now also pays for year one.
- Regulation S-P requires written safeguards reasonably designed to protect against anticipated threats to customer information.
- A dated inventory and remediation record belongs in the adviser's annual compliance review file.
What changes on October 13, 2026?
Two Microsoft deadlines land together. Office 2021 reaches end of life on October 13, 2026, when Microsoft ends support, and the first year of paid Extended Security Updates (ESU) for Windows 10 runs out with the October 2026 security release. After that date, Office 2021 receives no security fixes at all, and a Windows 10 PC without year two coverage stops receiving them too.
Microsoft is unusually blunt about Office 2021. Its end of support notice says the apps may keep working, but there will be "no extension and no extended security updates," and that continuing to use them "could expose yourself to serious and potentially harmful security risks." The Microsoft lifecycle page for Office 2021 lists the retirement as 6:59 a.m. Pacific on October 14, 2026, which is the end of the October 13 support day.
Windows 10 itself reached end of support on October 14, 2025. Firms that could not replace every PC in time bought commercial ESU. Microsoft's ESU program page says the program "must be purchased by year," that coverage lasts "a maximum of three years after end of support," and that year one cost $61 per device. The price "doubles every consecutive year," which puts year two at $122 per device.
Why should an RIA's CCO care about a software lifecycle date?
Regulation S-P requires a firm to protect customer information, and unpatched software is one of the most predictable ways that protection fails. Under 17 CFR 248.30(a)(1) and (a)(2), every covered institution must maintain written policies and procedures for administrative, technical, and physical safeguards that are reasonably designed to "protect against any anticipated threats or hazards to the security or integrity of customer information."
A publicly announced end of security updates is about as anticipated as a threat gets. The date has been on Microsoft's site for years, and every vulnerability found in Office 2021 after October 13 stays open on every machine still running it. An examiner who finds Office 2021 or an uncovered Windows 10 PC in your environment can fairly ask how that squares with your written safeguards policy.
The SEC has said where it is looking. The Division of Examinations' fiscal year 2026 priorities state that examiners will assess whether registrants "are reasonably managing information security and operational risks," and that after the Reg S-P compliance dates, the Division "will examine whether firms have developed, implemented, and maintained policies and procedures" under the amended rule. Both compliance dates have now passed: December 3, 2025 for larger entities and June 3, 2026 for smaller ones.
If nobody at your firm clearly owns the written safeguards policy, settle that before the remediation work starts. We cover the options in who should own and sign your Reg S-P program.
Will Office 2021 still work after end of life?
Yes, and that is the risk. The applications will still open and documents will still save, but every new vulnerability stays unpatched. Nothing visible changes for the user, so an unsupported copy can sit on a partner's laptop or a front desk PC for months without anyone noticing.
The gap tends to hide in three places at advisory firms:
- Perpetual licenses bought for a new hire or a part-time employee instead of a Microsoft 365 seat.
- A shared PC in a conference room or reception area that was set up once and never revisited.
- A home computer an employee uses to reach firm email or files, which the firm never inventoried.
What does Windows 10 year two coverage actually cost a firm?
Year two is $122 per device, double year one, and Microsoft sells only full years. The program page says customers "can't buy partial periods," and that "if you decide to purchase the program in Year Two, you have to pay for Year One too, as ESUs are cumulative." A firm that skipped year one and wants coverage now pays for both years on each PC.
For most firms, that math argues for replacement over extension. Year three, if a firm needs it, doubles again to $244 per device, and coverage ends for good after that third year. Use year two as a bridge for a short list of PCs, each with a dated replacement plan.
What happens to your vendors' and service providers' machines?
The question reaches past your own office. Amended Rule 248.30(a)(5) requires written policies and procedures for overseeing service providers "through due diligence and monitoring," including that they protect against unauthorized access to customer information and notify you "as soon as possible, but no later than 72 hours after becoming aware" of a breach.
If your IT provider, bookkeeper, or outsourced compliance consultant touches client data from a Windows 10 machine without ESU, that is your oversight question to answer. Add one line to this year's vendor due diligence asking each provider to confirm that the systems handling your data run supported operating systems and Office versions.
What should an advisory firm do this quarter?
Work through these in order. Most firms can finish the inventory in a day.
- Pull a software inventory from your device management or remote monitoring tool and list every machine running Office 2021, Office 2019 or older, or Windows 10.
- For each Windows 10 PC, record whether it has year two ESU and when it will be replaced. A PC with neither has been unprotected since its last covered update.
- Move Office 2021 users to the Microsoft 365 apps included in most business plans, or retire the machine. Microsoft offers no ESU for Office 2021.
- Check home and personal devices that reach firm email or files. If you cannot inventory them, consider whether your access policy should require a managed device.
- Ask your service providers, in writing, to confirm supported software on systems that handle your client data, and keep their answers.
- Update the written safeguards policy so it names a standard for supported software and a timeline for remediation. Then save the inventory and remediation record with your annual compliance review file.
That last step matters at exam time. Advisers Act Rule 206(4)-7 requires an annual review of the adequacy and effectiveness of your policies and procedures, and a dated record of how you found and closed this gap is far stronger evidence than a policy that only says you keep software current.
Is this legal advice for my firm?
No. This article describes what Microsoft has announced and what Regulation S-P and the SEC's published priorities say. Whether a specific gap creates an exam finding for your firm depends on your facts, and your compliance counsel is the right person to make that call.
How s90 helps
s90 manages IT for advisory firms in Los Angeles and Orange County with exam readiness in mind. We inventory every device, flag unsupported software before the deadline, plan replacements, and document the work in a format your CCO can drop straight into the annual review file. If you want a second set of eyes on your Office and Windows 10 exposure before your next exam, we are glad to take a look.
