ASD ISM 1501 Replace unsupported operating systems
What it says
Operating systems that are no longer supported by vendors are replaced.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishReplace operating systems that are no longer supported to maintain security.
This control is about making sure your computers and devices are running up-to-date, supported versions of their operating systems, like Windows or MacOS. If you're using software that's no longer supported by the maker, your systems are more vulnerable to viruses and hackers because they don't get security updates. It's like leaving your home with the doors unlocked; you're inviting trouble that could cost you time, money, or more importantly, data.
Free. Save your status, tasks and notes.
Why it matters
Unsupported operating systems remain unpatched, increasing exposure to known exploits, malware and unauthorised access across the network.
How to implement
The IT team should conduct an inventory of all devices in the organisation.
They can do this by creating a list or spreadsheet to track each device, noting the operating system version and its support status. This helps in identifying which systems need to be replaced or updated.
Procurement should work with IT to plan the replacement of unsupported systems.
This involves checking the inventory list to find which systems are outdated and researching suitable replacements that meet the organisation's needs and budget.
Managers should communicate the importance of updates to their teams.
Arrange a meeting or send a memo explaining why using supported operating systems is crucial for security, reassuring everyone that updates are routine and necessary.
The IT team should set a regular schedule for checking operating system support status.
Set reminders to review this quarterly and ensure all systems remain in compliance with the support criteria.
IT should conduct training sessions for staff to understand the risks of outdated systems.
Practical, simple sessions can cover how unsupported systems pose a threat and provide guidance on recognising and reporting outdated software.
Keep it running
Maintain an OS register, track vendor end-of-support dates, and replace or upgrade systems before support ends; isolate exceptions and manage risk.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
An up-to-date inventory report of all devices.
Look at
The document to ensure it lists each device with its operating system version and current support status.
Good evidence
Shows a complete list with clear labels indicating which systems are supported and which are not.
- Check 2 of 5What an auditor asks for
Good evidence
Includes recent memos or meeting notes about this subject.
- Check 3 of 5What an auditor asks for
Ask for
To see the procurement plan for replacing unsupported systems.
Look at
How the plan prioritises replacements based on the level of risk and support status.
Good evidence
Shows a structured timeline and budget allocation for these updates.
- Check 4 of 5What an auditor asks for
Good evidence
Has detailed, recurring entries reflecting quarterly checks.
- Check 5 of 5What an auditor asks for
Ask for
Evidence of staff training on the risks of unsupported systems.
Look at
Attendance records or training materials that cover this topic.
Good evidence
Includes recent sessions and materials tailored to educate staff about these risks.
Mappings
Closest match in ASD Essential Eight: E8-PO-ML1.8, Replace unsupported operating systems, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1501 requires operating systems that are no longer supported by vendors to be replaced. Annex A 8.8 is broader by requiring the organisation to obtain technical vulnerability information, evaluate exposure, and take appropriate measures across systems in use. Replacing an unsupported OS (ISM-1501) is one specific treatment option that would typically result from Annex A 8.8's vulnerability management process.
ASD Essential Eight: 2 mappings
This control is equivalent to E8-PO-ML1.8.
ISM-1501 requires operating systems that are no longer supported by vendors to be replaced. E8-PO-ML1.8 states the same requirement to replace unsupported operating systems. Both controls align in intent and scope, focusing specifically on removing vendor-end-of-support OS to reduce security risk.
This control partially overlaps E8-PO-ML3.9.
E8-PO-ML3.9 requires organisations to use the latest or previous OS release. ISM-1501 requires replacing operating systems that are no longer supported by vendors, which often drives upgrades and aligns with staying current. However, E8-PO-ML3.9 can require upgrading even when a vendor still supports older releases, while ISM-1501 does not explicitly require being on latest/previous-only supported.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.