ASD ISM 1981 Replace unsupportable non-internet network devices
What it says
Non-internet-facing network devices that are no longer supported by vendors are replaced.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishReplace network devices not supported by vendors to maintain security.
This control means that any network devices which aren't connected to the internet but are no longer supported by their maker need to be replaced. This is important because unsupported devices don't receive security updates, leaving your network vulnerable to cyber threats that could disrupt operations or expose sensitive data.
Free. Save your status, tasks and notes.
Why it matters
If unsupported non-internet-facing network devices are not replaced, known vulnerabilities remain unpatched, increasing breach and outage risk.
How to implement
Procurement team should work with IT to identify devices nearing end-of-life.
Start by reviewing warranty and support documents to see which devices will soon be unsupported by vendors.
IT team should create a list of unsupported devices.
Conduct a full inventory check of network devices, noting their support status based on vendor information.
System owners must plan for replacements.
Meet with IT and management to discuss budget and prioritise replacing unsupported devices based on their role in the network.
Managers should engage staff on changes.
Communicate with employees about the timeline for replacing these devices and any expected downtime.
IT team should conduct a security review post-replacement.
Verify that the new devices have up-to-date security features and consider integrating them with existing security protocols.
Keep it running
Maintain an asset register and regularly audit vendor support status for non-internet-facing devices; schedule and track replacements before end-of-support.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The device inventory list: Request a report detailing all network devices in use.
Look at
The support status of each device. Good means all devices are under active support from vendors.
- Check 2 of 5What an auditor asks for
Ask for
The replacement plan document: Request the schedule or plan for replacing unsupported devices.
Look at
Target dates and responsible parties.
Good evidence
A detailed timeline with specific actions and responsible names.
- Check 3 of 5What an auditor asks for
Ask for
Purchase orders or invoices: Request records of recent purchases for new or replacement devices.
Look at
The model numbers and confirmation that these devices replace unsupported ones. Good shows alignment with devices listed in the inventory list as needing replacement.
- Check 4 of 5What an auditor asks for
Ask for
Vendor communications: Request emails or letters from vendors confirming end-of-life status.
Look at
The dates and model numbers mentioned. Good means clear details on which devices are no longer supported and from when.
- Check 5 of 5What an auditor asks for
Ask for
Post-replacement security review notes: Request documentation of security checks after installing new devices.
Look at
Test results or assessments of security features. Good means evidence of checks performed and issues reported and resolved.
Mappings
Closest match in ISO/IEC 27001: A.8.20, Network and network devices security, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.20.
ISM-1981 requires a specific action: replacing non-internet-facing network devices that are no longer vendor-supported. ISO/IEC 27001:2022 Annex A 8.20 requires networks and network devices to be secured, managed and controlled more broadly. ISM-1981 is a concrete lifecycle requirement that sits within the wider expectations of Annex A 8.20 for managing network device security.
ASD Essential Eight: 4 mappings
This control partially overlaps E8-PA-ML1.8.
ISM-1981 requires that non-internet-facing network devices that are no longer supported by vendors are replaced to reduce exposure from unpatched/end-of-life products. E8-PA-ML1.8 relates by requiring the organisation to remove vendor-unsupported online services, which is a similar end-of-support risk treatment (eliminate unsupported components). However, E8-PA-ML1.8 targets services and internet-facing exposure, while ISM-1981 is specifically about replacing non-internet-facing network hardware/devices.
This control partially overlaps E8-PA-ML1.9.
ISM-1981 requires that unsupported non-internet-facing network devices are replaced to avoid security gaps caused by lack of vendor fixes. E8-PA-ML1.9 relates by requiring removal of unsupported software applications (e.g. browsers, PDF, security products), which is another way to address end-of-life risk. The controls overlap on the principle of eliminating unsupported technology, but differ because E8-PA-ML1.9 focuses on application/software categories rather than network devices.
This control partially overlaps E8-PO-ML1.8.
ISM-1981 requires replacement of vendor-unsupported non-internet-facing network devices. E8-PO-ML1.8 is related because it mandates replacing vendor-unsupported operating systems, reflecting the same lifecycle/end-of-support risk management principle. The difference is scope: E8-PO-ML1.8 is about OS platforms generally, whereas ISM-1981 is specifically about network devices (hardware/appliances) that are not internet-facing.
This control supports E8-PO-ML3.3.
ISM-1981 requires replacement of non-internet-facing network devices that are no longer supported, reducing the number of devices that cannot be effectively patched or mitigated. E8-PO-ML3.3 requires applying critical patches (or vendor mitigations) to operating systems on non-internet-facing network devices within 48 hours. Replacing unsupported devices under ISM-1981 strengthens E8-PO-ML3.3 because patch timeliness is only achievable when the device/OS remains vendor-supported.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.