Essential Eight PA-ML1.8 Unsupported online services are removed by the organisation
What it says
Online services that are no longer supported by vendors are removed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRemove online services that the vendor no longer supports to enhance security.
This control is about removing any online services that the vendor no longer supports. It matters because unsupported services no longer receive security updates, making them easy targets for hackers. Without this control, your organisation could face data breaches and cyber attacks, as these outdated services act like open doors for cyber criminals.
Free. Save your status, tasks and notes.
Why it matters
Leaving unsupported online services in place exposes them to known vulnerabilities with no vendor patches, increasing the likelihood of compromise and data loss.
How to implement
IT team should conduct an inventory review to identify unsupported online services by checking vendor support policies and software versions.
The system administrator needs to uninstall unsupported services by using available uninstallation tools or methods recommended by the vendor.
Security officer should ensure the use of automated tools that regularly scan and report on the status of online services to flag unsupported ones.
The IT team should set up alerts with vendors to receive notifications about end-of-support dates for services directly impacting the organisation.
Business owners should communicate with their IT team to confirm which services are mission-critical and find supported alternatives if they're unsupported.
Keep it running
Maintain an inventory of internet-facing services, track vendor end-of-support dates, and decommission or replace services promptly when support ends.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
What process does the organisation use to identify unsupported online services?
Look at
Examine the inventory list of all online services with details on their support status from vendors.
Good evidence
The organisation provides a regularly updated list showing current support status and actions taken to remove or replace unsupported services.
- Check 2 of 2What an auditor asks for
Ask for
How does the organisation confirm that unsupported services are removed?
Look at
Check records of service removal, including logs from network monitoring tools or uninstall records.
Good evidence
The removal of unsupported services is documented with timestamps and confirmations from the IT team.
Mappings
Closest match in ASD Information Security Manual: ISM-1905, Remove online services no longer supported by vendors, which asks for the same thing.
ASD Information Security Manual: 5 mappings
This control is equivalent to ISM-1905.
E8-PA-ML1.8 requires organisations to remove online services that are no longer supported by vendors. ISM-1905 states the same requirement, aligning scope and intent, making these controls effectively interchangeable.
This control partially overlaps ISM-0304.
E8-PA-ML1.8 requires organisations to remove online services that are no longer supported by vendors. ISM-0304 similarly requires removal of vendor-unsupported software, including certain application categories, which aligns with the same end-state of eliminating unsupported components. However, ISM-0304 is focused on applications installed/used in the environment (with explicit category scoping), while E8-PA-ML1.8 is specifically about online services (service-exposed systems/components) rather than general application inventories.
This control partially overlaps ISM-1704.
ISM-1704 requires removing vendor-unsupported end-user and security software from systems. E8-PA-ML1.8 requires removing vendor-unsupported online services, applying the same lifecycle principle to externally hosted/service components. They overlap in intent (eliminating unsupported technology), but differ in scope (installed applications versus online services).
- ISM-1809Compensating controls for unsupported systems pending removal or replacementPartially overlaps
This control partially overlaps ISM-1809.
E8-PA-ML1.8 requires organisations to remove online services that are no longer supported by vendors. ISM-1809 addresses the related scenario where unsupported systems (including applications, operating systems and network devices) cannot be removed immediately and therefore require compensating controls until removal/replacement occurs. The controls overlap on the risk driver (vendor-unsupported technology), but ISM-1809 is about interim risk treatment whereas E8-PA-ML1.8 is about outright removal of unsupported online services.
This control partially overlaps ISM-1981.
ISM-1981 requires that non-internet-facing network devices that are no longer supported by vendors are replaced to reduce exposure from unpatched/end-of-life products. E8-PA-ML1.8 relates by requiring the organisation to remove vendor-unsupported online services, which is a similar end-of-support risk treatment (eliminate unsupported components). However, E8-PA-ML1.8 targets services and internet-facing exposure, while ISM-1981 is specifically about replacing non-internet-facing network hardware/devices.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.