ASD ISM 1704Remove Unsupported Software to Ensure Security
Official control statement
Office productivity suites, web browsers and their extensions, email clients, PDF applications, Adobe Flash Player, and security products that are no longer supported by vendors are removed.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Unsupported software like browsers, productivity tools, and security apps should be removed to maintain security.
What this means in practice
This control is about getting rid of software that's no longer supported by its maker. It matters because unsupported software doesn't get security updates, so it can be an easy target for hackers who might steal your data or disrupt your operations.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
June 2025
Control Stack last updated
29 Sept 2026
E8 maturity levels
ML1, ML2, ML3
Why it matters
Unsupported software can harbour vulnerabilities, exposing organisations to data breaches or operational disruptions from malware or cyber attacks.
Operational notes
Regularly audit for vendor end-of-support software (browsers/extensions, email, PDF, office suites, Flash and security tools) and remove or replace it promptly.
Implementation tips
- System owners should regularly review the software installed on all devices within the organisation. They can do this by creating an inventory list of current software versions and comparing it to the supported versions listed by manufacturers. By keeping this up to date, they can identify which software needs to be removed or replaced.
- The IT team should monitor announcements from software vendors regarding end-of-support dates. They can subscribe to vendor newsletters or alerts to stay informed and ensure that any software nearing or past its support deadline is flagged for removal.
- Managers should encourage employees to report any unsupported software they are aware of. They can create a simple reporting system, like via an internal email address or form, where staff can mention software issues or outdated applications.
- Procurement teams need to ensure that when acquiring new software, they only choose products with a clear support lifespan. They can do this by checking vendor support policies and ensuring there's a documented plan for regular updates as part of the purchase agreement.
- The IT team should set up automatic reminders well before software reaches its end-of-support date. Using tools like calendar alerts can help them plan and carry out the transition to supported software versions, minimising disruption.
Audit / evidence tips
- AskThe software inventory list: Request the document that lists all software currently installed across the organisationLook atDetails that show software names, versions, and last updated datesGoodList will also indicate which software is pending removal due to end-of-support
- AskTo see communications from software vendors: Request emails or notifications about software reaching end-of-supportLook atConfirmation that the organisation's IT team has addressed these notificationsGoodIndication is a documented plan for software removal or upgrade
- AskThe procurement policy: Request documentation of criteria for new software purchasesLook atClear guidelines that specify selecting supported software with defined lifecycle and support plans. Good documentation includes vendor policies on support and update practices
- AskEmployee communication logs: Request examples of communications sent to employees about reporting outdated softwareLook atClear instructions provided to staff and evidence of submitted reports. Good communication logs show regular reminders and active participation
- AskThe IT team's calendar alerts: Request to review the setup of automated alerts for software updates or removal deadlinesLook atA systematic approach where reminders are set well in advance of critical dates. Good practices demonstrate proactive scheduling and action plans
Cross-framework mappings
How ISM-1704 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.8 | ISM-1704 requires removing specific categories of unsupported software to reduce known and unpatched exposure | |
E8
| Control | Notes | Details |
|---|---|---|
equalEquivalent(1)expand_less | ||
| E8-PA-ML1.9 | ISM-1704 requires that specific categories of vendor-unsupported software (e.g | |
sync_altPartially overlaps(2)expand_less | ||
| E8-PA-ML1.8 | ISM-1704 requires removing vendor-unsupported end-user and security software from systems | |
| E8-PA-ML3.3 | ISM-1704 requires removal of vendor-unsupported office productivity suites, web browsers (and extensions), email clients, PDF application... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in System management
See all Guidelines for system management controls, or browse the full ASD ISM library.