Review the long-term risk of staying on Windows 10

But should you stay on Windows 10 even if you do opt to purchase ESU patches? First, review your cyber insurance policy for any coverage issues should you decide to continue with Windows 10 unpatched, or continue with Windows 10 with ESU coverage.

Cyber insurance policies often point to the PCI DSS standards for coverage maintenance guidelines. Protection can be denied or dropped based on, arising from, or in any way involving:

• Any insured’s failure to comply with or follow the PCI Data Security Standard or any payment card company rules.
• The implementation or maintenance of, or compliance with, any security measures or standards relating to any payment card Data including, but not limited to, any fine or penalty imposed by a payment card company on a merchant bank or payment processor that an Insured has paid or agreed to reimburse or indemnify.

For point-of-sale systems, for example, the PCI DSS standards indicate that systems are protected with required controls — file integrity monitoring, anti-malware, patches, audit logging, and so on. Thus, to be in compliance with PCI DSS standards, you can’t leave point-of-sale systems installed, operating, and interacting with customers if you knowingly do not keep them protected and patched. You would risk losing cyber insurance coverage if you did not have protections in place.