ASD ISM 1809 Compensating controls for unsupported systems pending removal or replacement
What it says
When applications, operating systems, network devices or networked IT equipment that are no longer supported by vendors cannot be immediately removed or replaced, compensating security controls are implemented until such time that they can be removed or replaced.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWhere end-of-support software, network devices or networked equipment cannot be retired straight away, extra protections must shield them until they are finally removed or replaced.
Every application, operating system, network device and piece of networked IT equipment eventually reaches a point where its vendor stops supporting it. From that date there are no more security patches, so any new weakness discovered in it stays open for good. The ideal response is to remove or replace the item, but in practice that is not always possible immediately: a legacy application may run a critical business process, a replacement may be on order, or a migration may take months. This control covers exactly that gap. When an unsupported item genuinely cannot be removed or replaced right away, the organisation must put compensating security controls in place around it, and keep them in place until the item is finally gone. Compensating controls are alternative protections that reduce the risk the missing patches would otherwise leave open. The control does not prescribe which measures to use; it requires that appropriate measures exist for the whole period the unsupported item remains in service. Why it matters: unsupported technology is one of the most reliable footholds an attacker can look for. Vulnerabilities in end-of-life products are publicly known and exploit tooling is often freely available, so an unprotected legacy system on the network is close to an open door. Treating the interim period as a managed, protected state rather than an accepted blind spot is what keeps a temporary delay from becoming a permanent exposure.
Free. Save your status, tasks and notes.
Why it matters
Without compensating controls, unsupported applications, operating systems, network devices and equipment remain exposed to known, unpatchable vulnerabilities for as long as they stay in service. Attackers routinely target end-of-life products because exploits are public and reliable. A single compromised legacy host or device can be used to steal data, deploy ransomware or move laterally into supported systems, and the delay in replacement can quietly stretch from months into years with nothing shielding the gap. The organisation would also be unable to demonstrate that it managed the residual risk it knowingly accepted.
How to implement
IT asset owners identify every application, operating system, network device and networked IT equipment item that has passed its vendor support date by checking vendor lifecycle notices against the asset inventory, and flag each one for removal or replacement.
The system owner and IT manager assess each flagged item and document, with a business justification, why it cannot be removed or replaced immediately, along with a target date and a funded plan to retire it.
The security team selects and implements compensating controls for each unsupported item based on its exposure, for example isolating it on a restricted network segment, limiting the accounts and hosts that can reach it, hardening its configuration, or increasing logging and monitoring around it, and records the chosen measures against the item.
The IT operations team schedules recurring checks that the compensating controls remain in place and effective, re-verifying after any network, firewall or monitoring change, and adjusting the controls if the environment or threat picture changes.
The IT manager tracks the removal or replacement plan through to completion, then confirms the unsupported item has been fully decommissioned and formally retires the compensating controls only once it is gone.
Keep it running
Day to day, this control turns on two things: knowing which items in the environment are unsupported and cannot yet be removed or replaced, and keeping the protections around each of them live and working.
Maintain a current register of unsupported applications, operating systems, network devices and networked IT equipment. For each entry, record why immediate removal or replacement is not possible, the compensating controls applied, who owns them, and the planned removal or replacement date. Review the register on a regular cycle so that new end-of-support announcements are captured and stale entries are closed out once the item is gone.
Compensating controls need the same care as any other security control. Check periodically that they are still in place and still effective, particularly after network changes, firewall rule reviews or reconfiguration of monitoring tools. Track progress on the removal or replacement plan so the interim arrangement remains genuinely temporary, and escalate when target dates slip. When the unsupported item is finally retired, confirm it has been fully decommissioned and update the register.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the register or list of applications, operating systems, network devices and networked IT equipment that are no longer supported by their vendors.
Look at
Check whether the register is complete when compared with the asset inventory and vendor lifecycle dates, and whether each entry records the reason it cannot yet be removed or replaced.
Good evidence
A current register that captures all four asset categories, is reconciled against the inventory, and documents a justification for each item that remains in service.
- Check 2 of 5What an auditor asks for
Ask for
Ask for the record of compensating security controls applied to each unsupported item.
Look at
Look for a specific mapping from each unsupported item to the controls protecting it, with an owner and the date the controls were implemented.
Good evidence
Every unsupported item has documented compensating controls that are proportionate to its exposure, rather than a generic statement that risks are managed.
- Check 3 of 5What an auditor asks for
Ask for
Ask for technical evidence that the compensating controls are actually in place, such as firewall rules, network segmentation configuration, access lists or monitoring configuration.
Look at
Compare the documented controls with the live configuration for a sample of unsupported items to see whether they match.
Good evidence
The live configuration confirms the documented controls are operating as described for the sampled items.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the removal or replacement plan for each unsupported item, including target dates and approval.
Look at
Check that each item has a defined end date and evidence of progress, and whether any slipped dates were reviewed and re-approved.
Good evidence
Each unsupported item has a realistic, approved plan to remove or replace it, and the compensating controls are clearly positioned as temporary measures until that happens.
- Check 5 of 5What an auditor asks for
Ask for
Ask for evidence of periodic reviews confirming the compensating controls remain in place and effective, and records of decommissioning for items that have since been retired.
Look at
Look for review dates, findings, any follow-up actions, and confirmation that controls were retired only after the unsupported item was removed or replaced.
Good evidence
Regular reviews are recorded, gaps found were fixed, and retired items show a closed-out entry with decommissioning confirmed.
Mappings
Closest match in ISO/IEC 27001: A.8.8, Management of technical vulnerabilities, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.8.8.
ISM-1809 requires organisations to implement compensating security controls when unsupported applications, operating systems, network devices or networked equipment cannot yet be removed or replaced. Annex A 8.8 requires obtaining vulnerability information, assessing exposure, and taking appropriate measures, which commonly includes additional controls for unpatched/end-of-support components. Annex A 8.8 is broader as it applies to all technical vulnerabilities (not only end-of-support), while ISM-1809 is more specific to the end-of-support condition and the interim-control objective until removal/replacement.
This control supports A.8.20.
ISM-1809 requires compensating controls to reduce risk from unsupported network devices or equipment until they can be removed or replaced. Annex A 8.20 focuses on securing, managing and controlling networks and network devices, which provides common compensating measures (e.g. segmentation, restrictive ACLs, hardened management planes) to contain unsupported assets. Annex A 8.20 does not specifically address end-of-support scenarios or the requirement to retire/replace, but it strengthens the practical control options used to meet ISM-1809.
ASD Essential Eight: 5 mappings
This control partially overlaps E8-PA-ML1.8.
E8-PA-ML1.8 requires organisations to remove online services that are no longer supported by vendors. ISM-1809 addresses the related scenario where unsupported systems (including applications, operating systems and network devices) cannot be removed immediately and therefore require compensating controls until removal/replacement occurs. The controls overlap on the risk driver (vendor-unsupported technology), but ISM-1809 is about interim risk treatment whereas E8-PA-ML1.8 is about outright removal of unsupported online services.
This control partially overlaps E8-PA-ML1.9.
E8-PA-ML1.9 requires organisations to remove specified software products once vendor support ends. ISM-1809 relates by addressing situations where unsupported applications, operating systems, or devices cannot yet be removed or replaced, requiring compensating controls until removal is possible. It overlaps with E8-PA-ML1.9 in managing the risk of unsupported technology, focusing on interim risk treatment.
This control partially overlaps E8-PA-ML3.3.
E8-PA-ML3.3 mandates removal of vendor-unsupported applications with defined exceptions to mitigate risk from unpatched software. ISM-1809 considers cases when unsupported applications, operating systems, and devices cannot be removed, necessitating compensating controls until removal or replacement. They overlap on managing the security risk of unsupported applications, but ISM-1809 is focused on interim risk treatment rather than the primary requirement to remove unsupported non-exempt applications.
This control partially overlaps E8-PO-ML1.8.
E8-PO-ML1.8 requires organisations to replace operating systems that are no longer supported by vendors. ISM-1809 handles scenarios where unsupported systems cannot immediately be replaced, requiring compensating controls, thus addressing interim risk until replacements occur.
This control supports E8-AH-ML1.1.
ISM-1809 requires compensating controls when unsupported systems cannot be immediately removed or replaced, recognising end-of-support technologies as a driver for additional risk treatment. E8-AH-ML1.1 mandates disabling or removing Internet Explorer 11, which is a concrete action to eliminate an unsupported/legacy component and therefore reduce the need for compensating controls under ISM-1809. ISM-1809 is broader because it covers any unsupported system type and focuses on interim protections until retirement, whereas E8-AH-ML1.1 is a specific hardening/removal requirement for one component.
ASD Essentials for enterprise IT: 2 mappings
- IT.GOV-14.1Identify, assess and treat legacy system risks until removal or replacementPartially overlaps
This control partially overlaps IT.GOV-14.1.
IT.GOV-14.1 requires legacy and unsupported technology risks to be treated with compensating controls, enhanced monitoring and assurance; ISM-1809 covers the compensating controls, required for unsupported applications, operating systems, network devices and networked IT equipment until removed or replaced.
- IT.PRO-06.3Remediate or mitigate above-threshold vulnerabilities within defined timeframes and verify effectivenessPartially overlaps
This control partially overlaps IT.PRO-06.3.
IT.PRO-06.3 requires vulnerabilities above risk thresholds to be remediated or mitigated, allowing for compensating controls; ISM-1809 requires such controls for unsupported applications, operating systems, network devices or networked IT equipment until they can be removed or replaced.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.