In the Servicing Exchange 2013 article there is the following Q&A regarding the support for Cumulative Updates (CUs):
Q: How long is a CU supported?
A: A CU will be supported for a period of three (3) months after the release date of the next CU. For example, if CU1 is released on 3/1 and CU2 is released on 6/1, CU1 support will end on 9/1.
As we know, a Service Pack (SP) is typically supported for 12 months after the next SP is released. However, since SP1 is CU4, what does this mean in terms of support for SP1? Will SP1 no longer be supported once CU6 gets released? No, not at all!
Lifecycle Support is the reason why CU4 is officially branded SP1 and not a CU, although technically it is. If we check the lifecycle for Exchange 2013, SP1 is explicitly mentioned and it is stated that its “support ends 12 months after the next service pack released”:
Which confirms the assumption: servicing model for CU’s, LifeCycle model for SP’s.
This also addresses the needs of Microsoft partners who want to certify their products against a release running at a slower cadence. SP1 will be supported according to the LifeCycle policy already mentioned (until 12 months after the release of a subsequent SP) but will only receive security updates. Customers who raise escalations requesting fixes or who want the benefits of the latest set of fixes will have to move to the appropriate CU to receive non security related fixes.