If a system is past vendor support and can't be replaced yet, then what?

Start

A system is past vendor support and can't be replaced yet

Past support means the vendor no longer releases security patches for that product or version. Every new flaw in it stays open for good, so the normal patch deadline cannot be met and the risk has to be managed another way until the system goes.

• Then: Enter it in the end-of-life register, with owner and end date

Step

Enter it in the end-of-life register, with owner and end date

In the pack, every system within 12 months of the end of support, or past it, is in the register with its owner, end date and plan, and reviewed at least quarterly. One row per product is enough where many devices run it. The monthly report counts systems past support that have neither an unexpired exception nor a retirement date; the target is none.

• Then: Is the system still needed?

Decision

Is the system still needed?

Ask the owner, and if the system is no longer needed, retire it now. Often only one function keeps it alive: in the pack's example a storage appliance was still needed only until its scanned delivery notes moved to a share on a supported file server.

• No: Retire it now
• Yes, or not known: Can it move to a supported version or product now?

Outcome

Retire it now

If it is no longer needed, retire it now rather than protect it. Close its row in the register once it is switched off.

Decision

Can it move to a supported version or product now?

Upgrading or replacing is the only lasting answer; everything else buys time. Version upgrades are best planned well before support ends: the pack's default is 6 months before, with the system in the register from 12 months before.

• Yes: Upgrade or replace it: the only lasting answer
• Not yet: Does the vendor sell extended security updates for it?

Outcome

Upgrade or replace it: the only lasting answer

Plan the move with a date and an owner, and keep the row in the register until the old version is gone. If the move will take months, answer "Not yet" instead and protect the system until the move is done.

Decision

Does the vendor sell extended security updates for it?

Some vendors still release security patches after normal support ends, usually for a fee and for a limited time. Take the dates from the vendor's published lifecycle, not from memory. If you do not know whether it is offered, treat it as unavailable until you have the answer.

• Yes: Buy extended updates for the time replacement takes
• No, or not known: Isolate it: own segment, only the connections it needs

Outcome

Buy extended updates for the time replacement takes

With extended support the vendor still releases security patches, so patch it as normal. It stays in the register, with its replacement date and the date the extended support is paid to. In the pack's example a weighbridge PC's updates are bought a year at a time until its new software is in.

Step

Isolate it: own segment, only the connections it needs

Give it its own network segment with only the connections it needs, no internet, no email or browsing, and its administration interfaces off. In the pack's example the storage appliance was reachable only from three goods-in PCs, with its administration interface off, and the isolation was tested before the exception was requested.

• Then: Add compensating controls, and test each one

Step

Add compensating controls, and test each one

Use application allow-listing, closer monitoring, checked backups and the fewest accounts possible. A control counts only once it has been tested, and it is retested at each quarterly review. An untested control does not lower the exception's risk score, so it can push the decision to a more senior approver.

• Then: Request an exception, and set a retirement date

Step

Request an exception, and set a retirement date

Use the patch deferral form with the reason that no patch exists. It is scored as an exception: the band sets the approver, and the expiry is no later than the shorter of the band's maximum and 90 days, which is 30 days for a Critical band. The form's own example ran to the appliance's retirement date. A Critical band decision goes to the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, executive management.

• Then: Is the risk left outside appetite?

Decision

Is the risk left outside appetite?

Compare the risk that remains after the tested controls with the appetite your risk management process sets for its category. A broken rule is an exception, not a risk acceptance; but where the exception leaves a risk outside appetite, the approver that process requires for that position signs as well, and the stricter of the two applies. If you cannot tell, ask the risk owner before the decision.

• Yes, or not known: The risk approver signs the exception as well
• No: At each quarterly review, will it retire before the exception ends?

Step

The risk approver signs the exception as well

The risk approver for that position adds a signature to the same exception. Record the date in the end-of-life register beside the exception's reference and expiry.

• Then: At each quarterly review, will it retire before the exception ends?

Decision

At each quarterly review, will it retire before the exception ends?

Review every row at least once a quarter, and whenever a vendor announces a new end-of-support date. Retest the controls, and check the exception's expiry against the retirement date. The pack's register warns 30 days before an exception expires.

• Yes: Retire it on its date, and close the exception
• No, or not known: Renew before expiry on a fresh assessment, or escalate

Outcome

Retire it on its date, and close the exception

Switch it off or replace it on the retirement date, and close the exception and the register row. The register flags a retirement date that has passed with the system still listed; a system still in use past support without an unexpired exception breaks the pack's rule.

Outcome

Renew before expiry on a fresh assessment, or escalate

A renewal is a new decision on a new score, made before the exception expires. Each band allows only so many renewals by the same approver; beyond that it goes up a level, so a system that keeps slipping becomes a management decision: fund the replacement, or change the rule.