Essential Eight PA-ML3.3 Remove unsupported applications excluding certain categories
What it says
Applications other than office productivity suites, web browsers and their extensions, email clients, PDF software, Adobe Flash Player, and security products that are no longer supported by vendors are removed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure unsupported non-critical applications are removed for security.
Imagine your computer is full of tools and apps. If some of these apps can't get updates or fixes from their creators, it's like leaving a window open to thieves. This control is about removing those outdated apps to keep the bad guys from sneaking in and causing trouble.
Free. Save your status, tasks and notes.
Why it matters
If unsupported (end-of-life) non-exempt apps remain installed, known unpatched flaws can be exploited to gain access, leading to compromise or data loss.
How to implement
System administrator should review all installed applications to identify which ones are no longer supported.
Use software inventory tools to make a list of all applications on the system.
IT team should prioritise removing unsupported applications.
Check vendor websites or support channels to confirm support status for each application.
IT manager needs to ensure that replacements for unsupported applications are identified and installed where necessary.
Research and choose alternative applications that are actively supported.
Security officer should implement a regular review process to prevent old, unsupported applications from remaining on the network.
Schedule quarterly reviews of application support status and document the findings.
Keep it running
Maintain an inventory and track vendor support dates; routinely uninstall end-of-life apps (outside the exempt categories) and validate replacements before rollout.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How do you identify unsupported applications in your system?
Look at
Examine records from your software inventory tool and any reports on software status.
Good evidence
The system administrator should provide a current list of supported and unsupported applications, along with evidence of regular checks.
- Check 2 of 2What an auditor asks for
Ask for
What process do you follow to remove unsupported applications?
Look at
Request documentation of recent removal actions taken for unsupported software.
Good evidence
Evidence showing when unsupported applications were removed and what replacements were implemented.
Mappings
Closest match in ASD Information Security Manual: ISM-0304, Remove unsupported applications for system security, which asks for the same thing.
ASD Information Security Manual: 5 mappings
This control is equivalent to ISM-0304.
E8-PA-ML3.3 requires organisations to remove vendor-unsupported applications, excluding specific categories such as office suites, browsers/extensions, email clients, PDF software, Flash, and security products. ISM-0304 states the same requirement with the same exceptions, aligning directly with the Essential Eight intent. Both controls focus on reducing exposure from unpatched/unsupported non-exempt applications by removing them.
This control partially overlaps ISM-1483.
ISM-1483 requires that internet-facing server applications are kept on their latest release to reduce exposure to known vulnerabilities. E8-PA-ML3.3 relates by requiring removal of applications that are no longer vendor-supported, which is a key driver for upgrading to current releases. However, E8-PA-ML3.3 applies broadly to many application types and focuses on support status, while ISM-1483 is specifically about internet-facing server applications being on the latest release.
This control partially overlaps ISM-1704.
ISM-1704 requires removal of vendor-unsupported office productivity suites, web browsers (and extensions), email clients, PDF applications, Flash, and security products. E8-PA-ML3.3 requires removal of unsupported applications outside those categories, which complements ISM-1704 by addressing the remaining application estate. They overlap on the general principle of removing unsupported software, but each targets different application subsets.
- ISM-1809Compensating controls for unsupported systems pending removal or replacementPartially overlaps
This control partially overlaps ISM-1809.
E8-PA-ML3.3 mandates removal of vendor-unsupported applications with defined exceptions to mitigate risk from unpatched software. ISM-1809 considers cases when unsupported applications, operating systems, and devices cannot be removed, necessitating compensating controls until removal or replacement. They overlap on managing the security risk of unsupported applications, but ISM-1809 is focused on interim risk treatment rather than the primary requirement to remove unsupported non-exempt applications.
This control depends on ISM-1493.
ISM-1493 requires organisations to maintain and verify software registers so they can reliably identify installed applications and their support status. E8-PA-ML3.3 requires unsupported applications (with noted exclusions) to be removed, which depends on being able to identify where unsupported applications exist. ISM-1493 supports E8-PA-ML3.3 by enabling detection and verification of unsupported software across the fleet, but E8-PA-ML3.3 is a remediation requirement rather than a register maintenance requirement.
ASD Essentials for enterprise IT: 1 mapping
- IT.PRO-04.1Define approved hardening baselines disabling unneeded services, insecure settings and weak protocolsPartially overlaps
This control partially overlaps IT.PRO-04.1.
IT.PRO-04.1 requires approved configuration baselines that disable or remove unnecessary services, insecure settings and unsupported or weak communication protocols; E8-PA-ML3.3 is related but concerns applications, requiring removal of vendor-unsupported applications other than office, browser, email, PDF, Flash and security software.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.