ASD ISM 1753Replace Unsupported Internet-Facing Devices
Official control statement
Internet-facing network devices that are no longer supported by vendors are replaced.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Replace network devices that are no longer supported by manufacturers.
What this means in practice
This control is about making sure that the devices on your network, like routers and firewalls, that connect directly to the internet are supported by their manufacturers. This matters because unsupported devices don't get security updates, which can leave them vulnerable to hackers who could steal your data or disrupt your services.
Framework
ASD Information Security Manual (ISM)
Control effect (Control Stack)
Preventative
Classifications
NC, OS, P, S, TS
ISM last updated
Dec 2024
Control Stack last updated
29 Sept 2026
E8 maturity levels
N/A
Why it matters
Unsupported internet-facing devices expose the organisation to unpatched vulnerabilities, leading to potential breaches or service disruptions.
Operational notes
Regularly check device support status, plan replacements before support ends to ensure continuous vendor security updates.
Implementation tips
- The IT team should create an inventory of all internet-facing devices. This involves listing every router, firewall, and other devices connected to the internet in a document or spreadsheet, noting their model and firmware version.
- IT Managers should regularly check for announcements from device manufacturers. Subscribe to the manufacturer's mailing list or regularly visit their website to stay informed about end-of-life dates for devices your organisation uses.
- The procurement team should plan for replacement if a device is nearing its end-of-support date. This includes researching compatible current models, getting quotes, and preparing a budget proposal well in advance of the device becoming unsupported.
- System owners must coordinate with the IT team to schedule replacements before devices reach their end-of-life. Ensure minimal disruption by planning updates during off-peak times or periods of scheduled maintenance.
- The IT team should maintain documentation that records when each device will no longer be supported. Keep this record updated and review it quarterly to identify any devices that will soon require replacement.
Audit / evidence tips
- AskThe device inventory list: Request a document that lists all internet-facing devices, including make, model, and firmwareLook atThe updated version numbers and model statusGoodList will have all devices tracked with clear information about their support status
- AskManufacturer notifications or announcements: Request emails or documents from vendors about device support timelinesLook atOfficial notifications regarding end-of-support datesGoodIncludes timely updates and proactive planning records for upcoming replacements
- AskThe replacement schedule: Request a plan that outlines when and how unsupported devices will be replacedLook atStructured timelines that align with end-of-support datesGoodProvides clear deadlines and steps showing proactive management
- AskEvidence of recent replacements: Request documentation or records of devices that were replaced in the last yearLook atPurchase records, invoices, or installation logsGoodRecent replacements align with end-of-support deadlines
- AskTo see the budget plan for device replacements: Request copies of budget proposals or purchase order approvals specific to replacing outdated devicesLook atApproved budgets or expenditures directly addressing replacementsGoodIncludes written proof that funds were allocated in advance
Cross-framework mappings
How ISM-1753 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.20 | ISM-1753 requires that internet-facing network devices that are no longer vendor-supported are replaced | |
E8
| Control | Notes | Details |
|---|---|---|
sync_altPartially overlaps(1)expand_less | ||
| E8-PO-ML1.8 | ISM-1753 requires that internet-facing network devices that are no longer vendor-supported are replaced | |
handshakeSupports(1)expand_less | ||
| E8-PO-ML1.5 | ISM-1753 requires replacement of internet-facing network devices that are no longer supported by vendors | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in System management
See all Guidelines for system management controls, or browse the full ASD ISM library.