Each door is one change, ordered by the exposure it removes and the certification requirements it completes per hour of work. Fixes interact, so the order is recalculated after every one.
−1.3 exposure4 hoursDEV-003
Unsupported operating systems no longer receive security fixes. Any in-scope unsupported device is an automatic Cyber Essentials failure.