Essential Eight PA-ML1.9 Removal of unsupported software and applications
What it says
Office productivity suites, web browsers and their extensions, email clients, PDF software, Adobe Flash Player, and security products that are no longer supported by vendors are removed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRemove office, browser, and security software that is no longer supported by the vendor.
Removing software that is no longer supported by its vendor is crucial because outdated software can expose your organisation to security threats. Without regular updates, these programs can have holes that cybercriminals exploit, potentially leading to data breaches or malware attacks.
Free. Save your status, tasks and notes.
Why it matters
Failure to remove unsupported software leaves systems vulnerable to exploits, increasing the risk of breaches and costly remediation efforts.
How to implement
System administrator should regularly review the list of installed software to identify any that are no longer supported by their vendors.
IT team must update the organisation's inventory to include the end-of-support dates for all critical software as part of their asset management process.
The security officer should enforce a policy that requires immediate removal of unsupported software to ensure compliance with security protocols.
IT personnel should use automated tools or software management platforms to scan and report on software versions and their support status.
Keep it running
Audit browsers, Office/PDF apps, email clients, extensions and security tools; remove vendor-unsupported versions promptly.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How do you determine which software is unsupported by vendors?
Look at
Examine the software inventory list and vendor support documentation.
Good evidence
The organisation maintains a current list of all software with vendor support dates, and unsupported software is promptly removed.
- Check 2 of 2What an auditor asks for
Ask for
How do you ensure unsupported applications are removed in a timely manner?
Look at
Review automated reports or logs indicating software removal activities following the end of vendor support.
Good evidence
Regular reports show timely removal of unsupported software, backed by detailed logs.
Mappings
Closest match in ASD Information Security Manual: ISM-1704, Remove unsupported software to ensure security, which asks for the same thing.
ASD Information Security Manual: 9 mappings
This control is equivalent to ISM-1704.
ISM-1704 requires that specific categories of vendor-unsupported software (e.g. office suites, browsers and extensions, email clients, PDF applications, Flash, and security products) are removed. E8-PA-ML1.9 states the same requirement with the same software categories and the same removal expectation. The scope and intent align closely, making implementation of either control largely satisfy the other.
This control is broader than ISM-1654.
ISM-1654 requires Internet Explorer 11 to be disabled or removed. E8-PA-ML1.9 requires removal of multiple categories of unsupported software (including web browsers) when vendor support ceases, which would include Internet Explorer 11 in most environments. ISM-1654 is a specific instance focused solely on IE11, while E8-PA-ML1.9 is broader across many application types and support status conditions.
This control partially overlaps ISM-0304.
E8-PA-ML1.9 requires removal of specific common application categories when they are no longer supported by vendors. ISM-0304 relates by requiring removal of other non-listed applications that are no longer vendor-supported, extending the same unsupported-software risk treatment to additional application types. The controls align on 'remove unsupported applications', but each covers a different scope of application categories.
This control partially overlaps ISM-1247.
ISM-1247 requires unneeded user accounts, components, services and functionality of server applications to be disabled or removed. E8-PA-ML1.9 relates by removing no-longer-supported applications, which often reduces unnecessary functionality and attack surface on servers and endpoints. However, E8-PA-ML1.9 focuses on vendor support status and specific software categories, while ISM-1247 focuses on disabling/removing unneeded features regardless of support status.
This control partially overlaps ISM-1467.
ISM-1467 requires organisations to ensure the latest releases of office suites, web browsers and extensions, email clients, PDF applications, and security products are used. E8-PA-ML1.9 directly relates by requiring that those same product categories are removed when vendor support ends, which is a key condition that prevents running non-current/non-patchable versions. ISM-1467 is broader in that it explicitly mandates being on the latest release (even when still supported), while E8-PA-ML1.9 focuses specifically on eliminating unsupported software.
- ISM-1809Compensating controls for unsupported systems pending removal or replacementPartially overlaps
This control partially overlaps ISM-1809.
E8-PA-ML1.9 requires organisations to remove specified software products once vendor support ends. ISM-1809 relates by addressing situations where unsupported applications, operating systems, or devices cannot yet be removed or replaced, requiring compensating controls until removal is possible. It overlaps with E8-PA-ML1.9 in managing the risk of unsupported technology, focusing on interim risk treatment.
- ISM-1848Replace unsupported software-based isolation mechanisms sharing physical resourcesPartially overlaps
This control partially overlaps ISM-1848.
ISM-1848 requires replacing an isolation mechanism or underlying OS when vendor support ends, ensuring server security. E8-PA-ML1.9 deals with the end-of-life risk management for end-user and security software, highlighting a shared concern about unsupported software, though in different contexts.
This control partially overlaps ISM-1981.
ISM-1981 requires that unsupported non-internet-facing network devices are replaced to avoid security gaps caused by lack of vendor fixes. E8-PA-ML1.9 relates by requiring removal of unsupported software applications (e.g. browsers, PDF, security products), which is another way to address end-of-life risk. The controls overlap on the principle of eliminating unsupported technology, but differ because E8-PA-ML1.9 focuses on application/software categories rather than network devices.
This control depends on ISM-1643.
E8-PA-ML1.9 requires organisations to remove software that is no longer vendor-supported. ISM-1643 supports this by maintaining software versions and patch histories in registers, which enables an organisation to determine which instances need to be removed. E8-PA-ML1.9 is an outcome, while ISM-1643 provides the necessary recordkeeping.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.