ASD ISM 1753 Replace unsupported internet-facing devices
What it says
Internet-facing network devices that are no longer supported by vendors are replaced.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishReplace network devices that are no longer supported by manufacturers.
This control is about making sure that the devices on your network, like routers and firewalls, that connect directly to the internet are supported by their manufacturers. This matters because unsupported devices don't get security updates, which can leave them vulnerable to hackers who could steal your data or disrupt your services.
Free. Save your status, tasks and notes.
Why it matters
Unsupported internet-facing devices expose the organisation to unpatched vulnerabilities, leading to potential breaches or service disruptions.
How to implement
The IT team should create an inventory of all internet-facing devices.
This involves listing every router, firewall, and other devices connected to the internet in a document or spreadsheet, noting their model and firmware version.
IT Managers should regularly check for announcements from device manufacturers.
Subscribe to the manufacturer's mailing list or regularly visit their website to stay informed about end-of-life dates for devices your organisation uses.
The procurement team should plan for replacement if a device is nearing its end-of-support date.
This includes researching compatible current models, getting quotes, and preparing a budget proposal well in advance of the device becoming unsupported.
System owners must coordinate with the IT team to schedule replacements before devices reach their end-of-life.
Ensure minimal disruption by planning updates during off-peak times or periods of scheduled maintenance.
The IT team should maintain documentation that records when each device will no longer be supported.
Keep this record updated and review it quarterly to identify any devices that will soon require replacement.
Keep it running
Regularly check device support status, plan replacements before support ends to ensure continuous vendor security updates.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The device inventory list: Request a document that lists all internet-facing devices, including make, model, and firmware.
Look at
The updated version numbers and model status.
Good evidence
List will have all devices tracked with clear information about their support status.
- Check 2 of 5What an auditor asks for
Ask for
Manufacturer notifications or announcements: Request emails or documents from vendors about device support timelines.
Look at
Official notifications regarding end-of-support dates.
Good evidence
Includes timely updates and proactive planning records for upcoming replacements.
- Check 3 of 5What an auditor asks for
Ask for
The replacement schedule: Request a plan that outlines when and how unsupported devices will be replaced.
Look at
Structured timelines that align with end-of-support dates.
Good evidence
Provides clear deadlines and steps showing proactive management.
- Check 4 of 5What an auditor asks for
Ask for
Evidence of recent replacements: Request documentation or records of devices that were replaced in the last year.
Look at
Purchase records, invoices, or installation logs.
Good evidence
Recent replacements align with end-of-support deadlines.
- Check 5 of 5What an auditor asks for
Ask for
To see the budget plan for device replacements: Request copies of budget proposals or purchase order approvals specific to replacing outdated devices.
Look at
Approved budgets or expenditures directly addressing replacements.
Good evidence
Includes written proof that funds were allocated in advance.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.20.
ISM-1753 requires that internet-facing network devices that are no longer vendor-supported are replaced. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled, which would include lifecycle management practices such as keeping devices supported. ISM-1753 is a specific, prescriptive control within the broader network device security management expectations of Annex A 8.20.
ASD Essential Eight: 2 mappings
This control partially overlaps E8-PO-ML1.8.
ISM-1753 requires that internet-facing network devices that are no longer vendor-supported are replaced. E8-PO-ML1.8 similarly mandates replacing vendor-unsupported operating systems, which can include OS on internet-facing network devices. However, E8-PO-ML1.8 is OS-centric and not limited to internet-facing devices, while ISM-1753 is device-centric and explicitly targets internet-exposed network equipment.
This control supports E8-PO-ML1.5.
ISM-1753 requires replacement of internet-facing network devices that are no longer supported by vendors. E8-PO-ML1.5 drives rapid patching of vulnerabilities in operating systems of internet-facing servers and internet-facing network devices, reducing exposure while devices remain supported. ISM-1753 addresses end-of-support risk that patching cannot remediate once vendor updates cease, so E8-PO-ML1.5 strengthens but does not replace the need for device replacement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.