ASD Essentials IT.GOV-14.1 Identify, Assess and Treat Legacy System Risks Until Removal or Replacement
What it says
Establish and maintain a process for identifying, assessing and treating cyber security risks associated with legacy systems and unsupported technologies through compensating controls, enhanced monitoring and assurance until the systems can be removed or replaced.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishFinds old and unsupported technology, judges its risk, and adds extra safeguards, closer monitoring and checks until it is removed or replaced.
Most organisations run some old technology they cannot switch off yet, such as an operating system the vendor no longer updates. These are legacy systems. To meet this, an approved process sets clear rules for what counts as legacy. Each one is listed, reviewed on a set cycle and risk assessed, with treatments approved by the right person. It gets extra safeguards, closer monitoring and regular checks until a tracked plan removes or replaces it.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?Governance and culture: a capability domain, which ASD applies across all phases from the start.
Why it matters
Without this process, unsupported systems go unrecorded. Weaknesses their vendors no longer fix stay open, with no extra safeguards or closer watching. These systems can stay in service for years, giving an attacker a lasting way in to more sensitive systems.
How to implement
The security lead should write a legacy system process, approved by executives or the risk committee and reviewed on a set schedule.
Include clear legacy rules, such as no vendor support or being unable to meet security requirements.
IT operations and system owners should build a list of legacy systems and unsupported technology from the asset register, vendor end-of-support notices and discovery scans (automatic device searches).
Review it on the set cycle.
The system and risk owners should assess each legacy system's risks, covering what makes it legacy, how exposed it is and what data it holds.
Have the right authority approve the recorded treatments and leftover risk.
The security lead should add extra safeguards for each risk, such as walling it off and limiting who can log in.
Schedule checks such as safeguard tests or vulnerability scans, and have security operations watch it more closely.
The system owner should give each kept legacy system a written plan, with a target date, to remove, replace or move it.
Report progress to the governance committee, and keep the safeguards until the system is gone.
Keep it running
IT operations and system owners keep the legacy list current, adding systems as they meet the rules, such as when vendor support ends. At each scheduled review, confirm the safeguards still work and removal is on track. If a replacement date slips, or a new weakness has no vendor fix, reassess and seek fresh approval. This action applies organisation-wide, in every priority phase, so the process must cover legacy systems wherever they sit.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the legacy system process, its approval record and its legacy rules.
Look at
Whether it is approved and current, and its rules are written and classify similar systems the same way.
Good evidence
An approved, current process has clear legacy rules that classify systems consistently.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the legacy list and the records of its recent reviews.
Look at
Compare it with the asset register and end-of-support dates for missing systems or skipped reviews.
Good evidence
No legacy system is missing from the list, and every entry was reviewed on cycle.
- Check 3 of 5What an auditor asks for
Ask for
Ask for risk assessments and treatment decisions for a sample of legacy systems.
Look at
Whether each has a formal assessment and an approved treatment, or only an informal judgement.
Good evidence
Each sampled system has a written assessment and a treatment approved by the right authority.
- Check 4 of 5What an auditor asks for
Ask for
Ask for proof of extra safeguards, closer monitoring and checks for the same sample.
Look at
Whether any risk lacks a safeguard, monitoring is no closer than normal, or checks are out of date.
Good evidence
Every assessed risk has a working safeguard, with closer monitoring and recent checks.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the removal or replacement plan for each kept legacy system, and recent progress reports.
Look at
Whether systems lack a plan, plans go untracked, or dates slip without a fresh risk decision.
Good evidence
Each kept system follows a tracked plan with a target date until removal or replacement.
ASD indicators of good practice (15)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(5)
- NE-1No documented or approved governance process exists for identifying or managing legacy systems.
- NE-2Legacy systems are not formally identified within the environment.
- NE-3Cyber security risks associated with legacy systems are not assessed or are assessed informally.
- NE-4There are no interim compensating controls to manage identified cyber security risks associated with legacy systems.
- NE-5Legacy systems remain in operation indefinitely with no documented decommissioning, replacement or migration path.
Partially effective(5)
- PE-1A process exists but the criteria for classifying a system as legacy are not documented or are inconsistently applied.
- PE-2Some legacy systems are identified but the inventory is incomplete or is not maintained.
- PE-3Risk assessments are conducted for some legacy systems but treatment decisions are not documented or approved.
- PE-4Some compensating controls are in place to address risks associated with legacy systems, but coverage is not complete.
- PE-5A path exists for some legacy systems but is not tracked to completion.
Fully effective(5)
- FE-1A documented and approved governance process exists with clear criteria for classifying systems as legacy.
- FE-2Legacy systems are formally identified, inventoried and reviewed on a cycle defined by the organisation.
- FE-3Cyber security risks associated with legacy systems are assessed, treated and approved by an appropriate authority.
- FE-4Compensating controls are applied to manage cyber security risks for legacy systems while decommissioning or migration efforts are in progress.
- FE-5A documented decommissioning, replacement or migration path exists for retained legacy systems and is tracked to completion.
Mappings
Closest match in ISO/IEC 27001: A.8.8, Management of Technical Vulnerabilities, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.8.8.
IT.GOV-14.1 requires a process to identify, assess and treat the cyber security risks of legacy systems and unsupported technologies through compensating controls, enhanced monitoring and assurance until they are removed or replaced. This overlaps with ISO/IEC 27001 Annex A 8.8, which requires exposure to technical vulnerabilities to be evaluated and appropriate measures taken, because unsupported technologies typically carry vulnerabilities that can no longer be patched and must be treated by other means. Annex A 8.8 applies to vulnerabilities in all systems in use, while IT.GOV-14.1 is limited to legacy and unsupported technology but also addresses its wider risks and eventual replacement.
ASD Essential Eight: 1 mapping
This control partially overlaps E8-PO-ML1.8.
IT.GOV-14.1 requires legacy and unsupported technology risks to be treated with compensating controls, enhanced monitoring and assurance until removal or replacement; E8-PO-ML1.8 sets that end point for one case, replacing operating systems that vendors no longer support.
ASD Information Security Manual: 3 mappings
This control partially overlaps ISM-1203.
IT.GOV-14.1 requires a process to identify, assess and treat cyber security risks from legacy systems and unsupported technologies; ISM-1203 supports the assessment step more broadly, with system owners conducting a threat and risk assessment for each system, legacy ones included.
- ISM-1526System Owners Continuously Monitor Security and Manage Threats, Risks and ControlsPartially overlaps
This control partially overlaps ISM-1526.
IT.GOV-14.1 requires legacy and unsupported technology risks to be treated with compensating controls, enhanced monitoring and assurance; ISM-1526 is broader, with system owners continuously monitoring each system's security and managing its threats, risks and controls.
- ISM-1809Compensating Controls for Unsupported Systems Pending Removal or ReplacementPartially overlaps
This control partially overlaps ISM-1809.
IT.GOV-14.1 requires legacy and unsupported technology risks to be treated with compensating controls, enhanced monitoring and assurance; ISM-1809 covers the compensating controls, required for unsupported applications, operating systems, network devices and networked IT equipment until removed or replaced.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.