ASD ISM 1704 Remove unsupported software to ensure security
What it says
Office productivity suites, web browsers and their extensions, email clients, PDF applications, Adobe Flash Player, and security products that are no longer supported by vendors are removed.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishUnsupported software like browsers, productivity tools, and security apps should be removed to maintain security.
This control is about getting rid of software that's no longer supported by its maker. It matters because unsupported software doesn't get security updates, so it can be an easy target for hackers who might steal your data or disrupt your operations.
Free. Save your status, tasks and notes.
Why it matters
Unsupported software can harbour vulnerabilities, exposing organisations to data breaches or operational disruptions from malware or cyber attacks.
How to implement
System owners should regularly review the software installed on all devices within the organisation.
They can do this by creating an inventory list of current software versions and comparing it to the supported versions listed by manufacturers. By keeping this up to date, they can identify which software needs to be removed or replaced.
The IT team should monitor announcements from software vendors regarding end-of-support dates.
They can subscribe to vendor newsletters or alerts to stay informed and ensure that any software nearing or past its support deadline is flagged for removal.
Managers should encourage employees to report any unsupported software they are aware of.
They can create a simple reporting system, like via an internal email address or form, where staff can mention software issues or outdated applications.
Procurement teams need to ensure that when acquiring new software, they only choose products with a clear support lifespan.
They can do this by checking vendor support policies and ensuring there's a documented plan for regular updates as part of the purchase agreement.
The IT team should set up automatic reminders well before software reaches its end-of-support date.
Using tools like calendar alerts can help them plan and carry out the transition to supported software versions, minimising disruption.
Keep it running
Regularly audit for vendor end-of-support software (browsers/extensions, email, PDF, office suites, Flash and security tools) and remove or replace it promptly.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The software inventory list: Request the document that lists all software currently installed across the organisation.
Look at
Details that show software names, versions, and last updated dates.
Good evidence
List will also indicate which software is pending removal due to end-of-support.
- Check 2 of 5What an auditor asks for
Ask for
To see communications from software vendors: Request emails or notifications about software reaching end-of-support.
Look at
Confirmation that the organisation's IT team has addressed these notifications.
Good evidence
Indication is a documented plan for software removal or upgrade.
- Check 3 of 5What an auditor asks for
Ask for
The procurement policy: Request documentation of criteria for new software purchases.
Look at
Clear guidelines that specify selecting supported software with defined lifecycle and support plans. Good documentation includes vendor policies on support and update practices.
- Check 4 of 5What an auditor asks for
Ask for
Employee communication logs: Request examples of communications sent to employees about reporting outdated software.
Look at
Clear instructions provided to staff and evidence of submitted reports. Good communication logs show regular reminders and active participation.
- Check 5 of 5What an auditor asks for
Ask for
The IT team's calendar alerts: Request to review the setup of automated alerts for software updates or removal deadlines.
Look at
A systematic approach where reminders are set well in advance of critical dates. Good practices demonstrate proactive scheduling and action plans.
Mappings
Closest match in ASD Essential Eight: E8-PA-ML1.9, Removal of unsupported software and applications, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.8.
ISM-1704 requires removing specific categories of unsupported software to reduce known and unpatched exposure. Annex A 8.8 requires the organisation to obtain vulnerability information, evaluate exposure, and take appropriate measures to address technical vulnerabilities. Removing unsupported software under ISM-1704 is a concrete risk treatment that supports the broader vulnerability management expectations in Annex A 8.8.
ASD Essential Eight: 3 mappings
This control is equivalent to E8-PA-ML1.9.
ISM-1704 requires that specific categories of vendor-unsupported software (e.g. office suites, browsers and extensions, email clients, PDF applications, Flash, and security products) are removed. E8-PA-ML1.9 states the same requirement with the same software categories and the same removal expectation. The scope and intent align closely, making implementation of either control largely satisfy the other.
This control partially overlaps E8-PA-ML1.8.
ISM-1704 requires removing vendor-unsupported end-user and security software from systems. E8-PA-ML1.8 requires removing vendor-unsupported online services, applying the same lifecycle principle to externally hosted/service components. They overlap in intent (eliminating unsupported technology), but differ in scope (installed applications versus online services).
This control partially overlaps E8-PA-ML3.3.
ISM-1704 requires removal of vendor-unsupported office productivity suites, web browsers (and extensions), email clients, PDF applications, Flash, and security products. E8-PA-ML3.3 requires removal of unsupported applications outside those categories, which complements ISM-1704 by addressing the remaining application estate. They overlap on the general principle of removing unsupported software, but each targets different application subsets.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.