ASD ISM 2053 End of life procedures for software
What it says
End of life procedures for software, including procedures for software removal and the archival or destruction of user accounts and data, are produced and made available to consumers.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCreate and share procedures for removing software and managing user accounts at its end of life.
This control is all about having a clear plan for what to do when software we use reaches its 'end of life,' meaning it's no longer supported or updated. This is important because outdated software can be a security risk, leaving us vulnerable to attacks and data breaches.
Free. Save your status, tasks and notes.
Why it matters
Without proper procedures for retiring software, organisations risk using insecure systems, leading to potential data breaches or operational disruptions.
How to implement
Managers should work with their IT team to identify software nearing end of life.
They can do this by checking software providers' updates and support timelines, and setting reminders for review well before support ends.
IT teams should create clear procedures for removing software safely.
This involves listing steps to uninstall the software and ensuring that no components are left running on any devices.
HR should collaborate with IT to make sure all user accounts associated with end-of-life software are properly managed.
This means archiving needed data and removing access to protect company information.
System owners must ensure alternative software solutions are planned and tested before current software is retired.
Engage with users to verify new options meet business needs.
Procurement should keep records of all software and its lifecycle status.
This can be done with a simple spreadsheet, logging purchase dates, version details, and end-of-life dates.
Keep it running
Keep track of approaching software end-of-life dates and start planning transitions early to avoid disruptions.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the software inventory list: Request a document showing all software in use and its end-of-life dates.
Look at
completeness and updated entries.
Good evidence
a current inventory showing recent reviews and actions for end-of-life software.
- Check 2 of 5What an auditor asks for
Ask for
the organisation's decommissioning procedure: See the steps laid out for safely removing software.
Look at
clear sequences, responsible persons, and security considerations.
Good evidence
a comprehensive document tested and approved by key stakeholders.
- Check 3 of 5What an auditor asks for
Look at
time-stamped actions with responsible person noted.
Good evidence
logs showing systematic deactivation in line with policies.
- Check 4 of 5What an auditor asks for
Look at
evidence of trials or pilot tests.
Good evidence
documented plans showing user feedback and planned go-live dates.
- Check 5 of 5What an auditor asks for
Ask for
to see the communication sent to staff about software changes: Check that details about software removal and new software instructions were shared well in advance.
Good evidence
emails or memos that clearly explain the change timeline and actions required by staff.
Mappings
Closest match in ISO/IEC 27001: A.5.16, Identity life cycle management, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.16.
ISM-2053 requires organisations to define end-of-life procedures for software, including how to archive or destroy user accounts and associated data when software is retired. ISO/IEC 27001:2022 Annex A 5.16 overlaps because it requires identities to be managed across their full lifecycle, including modification and de-provisioning when systems are decommissioned. Annex A 5.16 is identity-centric across all systems, whereas ISM-2053 is triggered by software retirement and covers software removal as well.
This control partially overlaps A.8.10.
ISM-2053 requires documented software EOL procedures that explain how to remove retired software and how to archive or destroy related user accounts and data, making those procedures available to consumers. ISO/IEC 27001:2022 Annex A 8.10 overlaps by requiring secure deletion of information when no longer required, which is a key step within many software decommissioning activities described by ISM-2053. Annex A 8.10 is broader across all information and media, while ISM-2053 additionally includes procedural guidance for software removal and account lifecycle actions.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.