Essential Eight PO-ML1.8 Replace unsupported operating systems
What it says
Operating systems that are no longer supported by vendors are replaced.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that all outdated and unsupported operating systems are replaced with supported versions.
Replacing unsupported operating systems is essential because when vendors stop supporting an operating system, they also stop providing updates and security patches. This leaves your systems vulnerable to cyber attacks, which could lead to data breaches or system failures.
Free. Save your status, tasks and notes.
Why it matters
Unsupported OSs expose your organisation to unpatched vulnerabilities, making it an easy target for cyber attacks that can lead to data breaches.
How to implement
The IT team should regularly review the list of operating systems in use across the organisation to identify any that are no longer supported.
This can be done by consulting the vendor's official support and lifecycle documentation.
System administrators should create a plan to migrate systems from unsupported operating systems to supported ones.
This includes scheduling updates and informing users about potential downtimes.
Security officers should prioritise the replacement of unsupported operating systems that are critical to business operations or are internet-facing, as these are at higher risk of exploitation.
The IT team should regularly check the operating systems of all new devices before they are connected to the network, ensuring they are supported versions.
Keep it running
Regularly inventory systems to identify unsupported OSs and plan timely upgrades before vendors cease support, ensuring continued security coverage.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
What process does the organisation have in place to identify unsupported operating systems?
Look at
Review the system inventory documentation.
Good evidence
A regularly updated document that lists operating systems and indicates their support status.
- Check 2 of 3What an auditor asks for
Ask for
How does the organisation prioritise updating unsupported systems?
Look at
Review the migration plan or schedule.
Good evidence
A detailed plan that prioritises systems based on risk and criticality, including timelines for upgrading.
- Check 3 of 3What an auditor asks for
Ask for
How often are the systems in the organisation checked for outdated operating systems?
Look at
Examine logs of operating system checks or scans.
Good evidence
Logs showing regular checks and proactive actions taken to replace unsupported systems.
Mappings
Closest match in ASD Information Security Manual: ISM-1501, Replace unsupported operating systems, which asks for the same thing.
ASD Information Security Manual: 9 mappings
This control is equivalent to ISM-1501.
ISM-1501 requires operating systems that are no longer supported by vendors to be replaced. E8-PO-ML1.8 states the same requirement to replace unsupported operating systems. Both controls align in intent and scope, focusing specifically on removing vendor-end-of-support OS to reduce security risk.
This control partially overlaps ISM-0298.
E8-PO-ML1.8 requires organisations to replace operating systems that are no longer supported by vendors. ISM-0298 overlaps by enforcing a centralised method for patching operating systems, a key practice for maintaining support before the end-of-support. However, it doesn't fully address the need for replacement where no upgrade path exists.
This control partially overlaps ISM-1407.
ISM-1407 requires organisations to use only the latest or previous operating system releases. E8-PO-ML1.8 focuses on replacing operating systems that are no longer vendor-supported, which commonly drives upgrades but does not necessarily enforce 'latest or previous' where older supported releases still exist. The controls overlap on avoiding obsolete OSs, but ISM-1407 is stricter and version-specific while E8-PO-ML1.8 is framed around vendor support status.
This control partially overlaps ISM-1753.
ISM-1753 requires that internet-facing network devices that are no longer vendor-supported are replaced. E8-PO-ML1.8 similarly mandates replacing vendor-unsupported operating systems, which can include OS on internet-facing network devices. However, E8-PO-ML1.8 is OS-centric and not limited to internet-facing devices, while ISM-1753 is device-centric and explicitly targets internet-exposed network equipment.
- ISM-1809Compensating controls for unsupported systems pending removal or replacementPartially overlaps
This control partially overlaps ISM-1809.
E8-PO-ML1.8 requires organisations to replace operating systems that are no longer supported by vendors. ISM-1809 handles scenarios where unsupported systems cannot immediately be replaced, requiring compensating controls, thus addressing interim risk until replacements occur.
- ISM-1848Replace unsupported software-based isolation mechanisms sharing physical resourcesPartially overlaps
This control partially overlaps ISM-1848.
ISM-1848 requires that unsupported server isolation mechanisms or OS are replaced to maintain security. E8-PO-ML1.8 also mandates replacing unsupported operating systems, creating a direct overlap regarding end-of-support software replacements. Both controls focus on maintaining system integrity, albeit with different scopes.
This control partially overlaps ISM-1981.
ISM-1981 requires replacement of vendor-unsupported non-internet-facing network devices. E8-PO-ML1.8 is related because it mandates replacing vendor-unsupported operating systems, reflecting the same lifecycle/end-of-support risk management principle. The difference is scope: E8-PO-ML1.8 is about OS platforms generally, whereas ISM-1981 is specifically about network devices (hardware/appliances) that are not internet-facing.
This control partially overlaps ISM-1982.
ISM-1982 requires networked IT equipment that is no longer supported by vendors to be replaced. This overlaps with E8-PO-ML1.8, which requires replacing unsupported operating systems, as OS end-of-support is a common trigger for replacing or upgrading network-connected devices. ISM-1982 is broader in that it is equipment-focused (e.g. network devices/appliances), while E8-PO-ML1.8 is specifically OS-focused and can be satisfied by upgrading the OS without replacing the hardware.
This control depends on ISM-1643.
E8-PO-ML1.8 requires organisations to replace operating systems that are no longer supported by vendors. ISM-1643 supports this by requiring software registers to capture operating system versions and patch histories, which is necessary to identify which systems are out of support. Without the visibility mandated by ISM-1643, demonstrating and executing replacement under E8-PO-ML1.8 is significantly harder.
ASD Essentials for enterprise IT: 1 mapping
- IT.GOV-14.1Identify, assess and treat legacy system risks until removal or replacementPartially overlaps
This control partially overlaps IT.GOV-14.1.
IT.GOV-14.1 requires legacy and unsupported technology risks to be treated with compensating controls, enhanced monitoring and assurance until removal or replacement; E8-PO-ML1.8 sets that end point for one case, replacing operating systems that vendors no longer support.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.