GOV-14 Legacy system management
1 action under this Govern principle in Essentials for enterprise IT. Each action links to plain-English guidance, audit tips and cross-framework mappings.
ASD principle statement
Systems (infrastructure, operating systems, applications and data) that are not capable of meeting cyber security requirements are managed using compensating security controls, along with enhanced monitoring and assurance activities, to maintain an acceptable level of residual risk until they can be decommissioned or replaced.
Quoted as published. Everything else on this page is written by Control Stack.
- Function
- Govern
- Domains
The action
- IT.GOV-14.1Identify, Assess and Treat Legacy System Risks Until Removal or Replacement
Finds old and unsupported technology, judges its risk, and adds extra safeguards, closer monitoring and checks until it is removed or replaced.
Domains:Governance and culture
Back to the full ASD Essentials for enterprise IT action list, or browse the complete control library.