ASD ISM 0304 Remove unsupported applications for system security
What it says
Applications other than office productivity suites, web browsers and their extensions, email clients, PDF applications, Adobe Flash Player, and security products that are no longer supported by vendors are removed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishApplications no longer supported by vendors, except some key types, should be removed for security.
This control means we should get rid of any computer applications that the companies who made them no longer support, except for some essential ones like office software and security tools. This matters because unsupported applications no longer receive updates or bug fixes, which makes them a prime target for hackers and can lead to data breaches.
Free. Save your status, tasks and notes.
Why it matters
Unsupported applications have unpatched flaws attackers can exploit, increasing the likelihood of malware infection, data breaches and full system compromise.
How to implement
The IT team should regularly review the list of applications installed across all systems.
They can do this by running an inventory check using software tools that list all applications and their versions. The goal is to identify any applications that are no longer supported by their vendors.
Managers should ensure that employees are informed about why removing unsupported applications is important.
They can do this by sending out a simple email or holding a short meeting explaining the risks of unsupported software and the process for removal.
System owners need to work with the IT team to identify which software is critical and remains in use, comparing it with the vendor's support status.
This involves checking vendor websites or support documentation to confirm if the software is still supported.
The IT team should create a plan to replace or remove unsupported applications.
This plan should include identifying alternative options for critical applications and setting a timeline for removal. They should communicate this plan to all relevant staff.
Managers should ensure that there is a process in place for regularly reviewing and updating applications.
This can be handled by scheduling periodic reviews, perhaps quarterly, to capture any new unsupported applications as software lifecycles end.
Keep it running
Maintain an application inventory; routinely check vendor support status and remove or replace any unsupported apps (including browsers, plugins and PDF tools) promptly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
A current software inventory report: Request a document listing all installed applications and their versions.
Look at
Any software no longer supported as per vendor websites.
Good evidence
Lists all applications with their support status clearly indicated.
- Check 2 of 5What an auditor asks for
Good evidence
Includes evidence that staff have been informed about risks and removal processes.
- Check 3 of 5What an auditor asks for
Good evidence
Sees active identification and planning based on support status.
- Check 4 of 5What an auditor asks for
Ask for
How they verify vendor support.
Look at
Established procedures like checking vendor websites or using support portals.
Good evidence
Includes a clear, repeatable method.
- Check 5 of 5What an auditor asks for
Good evidence
Shows regular reviews are planned and include steps for dealing with unsupported applications.
Mappings
Closest match in ASD Essential Eight: E8-PA-ML1.9, Removal of unsupported software and applications, which asks for the same thing.
ASD Essential Eight: 4 mappings
This control is equivalent to E8-PA-ML1.9.
ISM-0304 requires that vendor-unsupported applications (with specific noted categories) are removed from systems to reduce exposure to unpatched vulnerabilities. E8-PA-ML1.9 states the same requirement using the same list of application categories (office suites, browsers/extensions, email clients, PDF software, Adobe Flash Player, and security products) that must be removed when unsupported. In practice, implementing E8-PA-ML1.9 would satisfy ISM-0304 with no material difference in scope.
This control is equivalent to E8-PA-ML3.3.
E8-PA-ML3.3 requires organisations to remove vendor-unsupported applications, excluding specific categories such as office suites, browsers/extensions, email clients, PDF software, Flash, and security products. ISM-0304 states the same requirement with the same exceptions, aligning directly with the Essential Eight intent. Both controls focus on reducing exposure from unpatched/unsupported non-exempt applications by removing them.
This control partially overlaps E8-PA-ML1.8.
E8-PA-ML1.8 requires organisations to remove online services that are no longer supported by vendors. ISM-0304 similarly requires removal of vendor-unsupported software, including certain application categories, which aligns with the same end-state of eliminating unsupported components. However, ISM-0304 is focused on applications installed/used in the environment (with explicit category scoping), while E8-PA-ML1.8 is specifically about online services (service-exposed systems/components) rather than general application inventories.
This control partially overlaps E8-PA-ML2.2.
ISM-0304 requires organisations to remove applications that are no longer supported by vendors (outside the listed key application categories). E8-PA-ML2.2 focuses on applying patches/updates/mitigations for vulnerabilities in those non-core applications within one month of release, which assumes the software remains in use and supported. They overlap in managing security risk from non-core applications, but ISM-0304 mandates removal when support ends while E8-PA-ML2.2 mandates timely patching while support exists.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.