Skip to content
OT principles
ASD Essentials

Essentials for OT

GOV-14 Legacy system management

one actionAlso in ASD Essentials for enterprise IT

Some OT systems are legacy (outdated) or unsupported but still critical to operations. Set up and keep a process to find, assess and manage their cyber security risk until you can remove or replace them.

Reviewed 18 October 2026 · Current to ASD's Essentials for OT, published 15 October 2026

The principle

Systems (infrastructure, operating systems, applications and data) that are not capable of meeting cyber security requirements are managed using compensating security controls, along with enhanced monitoring and assurance activities, to maintain an acceptable level of residual risk until they can be decommissioned or replaced.

ASD, Information Security Manual (ISM), Principle GOV-14

The action

ASD's actions are quoted as published in Essentials for OT. ASD has not given them IDs, so they are numbered by position.

  1. Action 1 of 1

    Establish and maintain a process for identifying, assessing and managing the cyber security risk associated with legacy and unsupported systems that remain operationally critical, until they can be removed or replaced.

    In plain English: Some legacy or unsupported systems stay critical to operations. Set up and keep a process to find, assess and manage their cyber security risk until removed or replaced.

    Domains
    Governance and culture

See all 34 principles in Essentials for OT, or read our OT guide.

Sources

The ASD publications this page quotes.

Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.

Everything else on this page is written by Control Stack.