Essentials for cloud
GOV-14 Legacy system management
Have a process to find, assess and treat the risks of legacy systems and unsupported technology. Manage those risks with compensating controls (other safeguards that reduce the same risk), closer monitoring and assurance until you can remove or replace them.
Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026
The principle
Systems (infrastructure, operating systems, applications and data) that are not capable of meeting cyber security requirements are managed using compensating security controls, along with enhanced monitoring and assurance activities, to maintain an acceptable level of residual risk until they can be decommissioned or replaced.
The action
ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.
- C: Customer
- S: Supplied
- P: Provider-inherited
Action 1 of 1
Establish and maintain a process for identifying, assessing and treating cyber security risks associated with legacy systems and unsupported technologies through compensating controls, enhanced monitoring and assurance until the systems can be removed or replaced.
In plain English: Maintain a process to find, assess and treat risks from legacy and unsupported technology. Use compensating controls, closer monitoring and assurance until it can be removed or replaced.
- Domains
- Governance and culture
- Who does it
- PaaSCustomer
- SaaSCustomer
See all 30 principles in Essentials for cloud, or read our cloud guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
Everything else on this page is written by Control Stack.