ASD ISM 1982 Replace unsupported networked IT equipment
What it says
Networked IT equipment that is no longer supported by vendors is replaced.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishReplace networked IT equipment when vendors no longer provide support.
This control is about replacing any networked IT equipment, like servers or routers, when the companies that make them stop supporting them with updates. This is important because unsupported equipment can become a weak link in your security, making it easier for hackers to get in and cause trouble, like stealing sensitive information or disrupting your operations.
Free. Save your status, tasks and notes.
Why it matters
Unsupported networked IT equipment cannot receive vendor patches, increasing exposure to known exploits, outages and data compromise.
How to implement
The IT team should maintain a list of all networked IT equipment and their support status.
They can do this by regularly checking manufacturer websites or contacting suppliers to ensure they have up-to-date information on support timelines.
Procurement should set up a process to replace unsupported equipment swiftly.
This process could include setting budget allocations for replacement and identifying preferred vendors who can provide timely replacements.
The manager should communicate the importance of replacing unsupported equipment to all staff.
This can be done through a brief team meeting, highlighting the risks of using outdated equipment and the steps the organisation is taking to address these risks.
The IT team should develop a timeline for replacing equipment that is reaching the end of its support.
Set milestones for purchasing, installation, and testing of new equipment, ensuring the process is seamless and minimally disruptive to the organisation.
The procurement team should work with the IT team to establish partnerships with vendors offering support contracts.
These partnerships can ensure quicker response times for replacements and better pricing due to established relationships.
Keep it running
Maintain an asset register with vendor end-of-support dates, review quarterly, and schedule procurement and cutover before support ends.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The inventory of all networked IT equipment: Request the most recent list maintained by the IT team.
Look at
The dates when support for each item ends.
Good evidence
Is an up-to-date inventory showing current support status for all equipment.
- Check 2 of 5What an auditor asks for
Ask for
Replacement plans related to soon-to-be unsupported equipment: Review any documents that outline the timeline and budget for replacing outdated equipment.
Look at
Clear timelines and allocated resources.
Good evidence
Plan should have specific steps and deadlines before the equipment becomes unsupported.
- Check 3 of 5What an auditor asks for
Ask for
Vendor communication records: Request copies of correspondence with vendors regarding support status.
Look at
The responses and support timelines provided by vendors. Good records will show proactive engagement and confirmation of support end dates.
- Check 4 of 5What an auditor asks for
Ask for
Budget allocations for replacing equipment: Review financial documents showing budget set aside for replacing unsupported IT gear.
Look at
Approved budget lines aligning with replacement needs.
Good evidence
Budget should adequately cover the cost of timely replacements.
- Check 5 of 5What an auditor asks for
Ask for
Training or communication materials sent to staff: Review emails, presentations, or meeting notes explaining the changes to staff.
Look at
Clear communication about the risks of unsupported equipment.
Good evidence
Communication record will show staff understanding and engagement with the replacement process.
Mappings
Closest match in ASD Essential Eight: E8-PO-ML1.8, Replace unsupported operating systems, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control depends on A.8.20.
ISM-1982 requires replacement of unsupported networked IT equipment to avoid operating network infrastructure that can no longer be securely maintained by the vendor. This supports Annex A 8.20 because ensuring network devices remain vendor-supported underpins secure management and control of network and network devices. Annex A 8.20 is broader and includes configuration, administration, and control requirements that go beyond replacement decisions.
ASD Essential Eight: 1 mapping
This control partially overlaps E8-PO-ML1.8.
ISM-1982 requires networked IT equipment that is no longer supported by vendors to be replaced. This overlaps with E8-PO-ML1.8, which requires replacing unsupported operating systems, as OS end-of-support is a common trigger for replacing or upgrading network-connected devices. ISM-1982 is broader in that it is equipment-focused (e.g. network devices/appliances), while E8-PO-ML1.8 is specifically OS-focused and can be satisfied by upgrading the OS without replacing the hardware.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.