ASD ISM 1905Remove Online Services No Longer Supported by Vendors
Online services that are no longer supported by their vendors are decommissioned and removed from use.
Plain language
This control ensures that any online service your organisation uses is removed once its vendor stops supporting it. When a vendor ends support, the service no longer receives security patches, so known weaknesses stay open for attackers to exploit. By retiring these services promptly and moving to supported alternatives, you avoid running software that can no longer be kept safe.
Framework
ASD Information Security Manual (ISM)
Control effect
Responsive
Classifications
NC, OS, P, S, TS
ISM last updated
Dec 2023
Control Stack last updated
10 Aug 2026
E8 maturity levels
ML1, ML2, ML3
Official control statement
Online services that are no longer supported by vendors are removed.
Why it matters
If unsupported online services remain in use, they stop receiving security patches and leave known vulnerabilities open for attackers to exploit.
Operational notes
Review the online service inventory on a regular schedule so services are retired promptly as soon as vendor support ends.
Implementation tips
- IT and asset owners maintain an inventory of all online services in use, recording each vendor's support status and end-of-life date.
- Administrators subscribe to vendor product lifecycle notifications so the organisation learns when a service is approaching end of support.
- The service owner plans and completes a migration to a supported alternative before the current service reaches its end-of-support date.
- Administrators decommission each unsupported online service by disabling access and deprovisioning its associated accounts and data.
- IT teams schedule periodic reviews of the service inventory to identify and remove any services that have since lost vendor support.
Audit / evidence tips
- AskAsk for the inventory of online services in use and each service's vendor support status.GoodA current inventory that clearly flags any service that is at or past its vendor support end date.
- AskAsk how the organisation is alerted when an online service reaches end of vendor support.GoodReliable notification arrangements that surface upcoming end-of-support dates before they arrive.
- AskAsk for evidence that online services no longer supported by vendors have been removed.GoodRecords showing each unsupported service was decommissioned and its access fully disabled.
- AskAsk whether any online services currently in use are past their vendor support end date.GoodNo active online services remain in use beyond their vendor support end date.
- AskAsk how often the online service inventory is reviewed for unsupported services.GoodRegular, dated reviews that identify services losing support and drive their removal.
Cross-framework mappings
How ISM-1905 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.8 | ISM-1905 requires removal of vendor-unsupported online services to reduce risk from vulnerabilities that can no longer be remediated | |
E8
| Control | Notes | Details |
|---|---|---|
linkRelated(1)expand_less | ||
| E8-PA-ML1.8 | E8-PA-ML1.8 requires organisations to remove online services that are no longer supported by vendors | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ASD ISM controls in System management
See all Guidelines for system management controls, or browse the full ASD ISM library.