End-of-Life Software & Unsupported System Register
Tracks systems past vendor support with compensating controls and planned retirement dates.
Available soon
- Format
- Excel
- Size
- 78 KB
- Length
- 12 sheets
- Version
- 1.0
- Updated
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Set the As-at date on the Summary. Type it; never use a formula that changes it. |
| 2 | Register: add every system or product whose vendor support ends within 12 months, or has ended. Take the dates from the vendor's published lifecycle, not from memory. One row per system, or per product where many devices run it; name the devices in 'What it is'. |
| 3 | Enter the owner, the end of support and, where the vendor sells it, the date extended support is paid to. Status calculates: Past support: no security patches; Past normal support: on extended support; Support ends within 12 months; Supported. |
| 4 | For each row, work through the options on the Options sheet in order and record what was decided (EO-1 to EO-6). Upgrading or replacing is the only lasting answer; everything else buys time. |
| 5 | For a system past support with no extended support: isolate it (EO-4), add and test compensating controls on the Controls sheet (EO-5), request a P02 exception through the Patch Deferral Request Form and enter its reference and expiry, and set a retirement date (EO-6). Where the risk left is outside appetite, the P05 approver signs too: enter the date. The PM-17 check lists anything missing. |
| 6 | Review every row at least once a quarter (P01 VM-15): enter the review date on the row and a line on the Reviews sheet. Renew the exception, or retire the system, before the exception expires. |
| 7 | Take the Summary's figures to the monthly report: PCM-04 counts systems past support that have neither an unexpired exception nor a retirement date. |
| 8 | To clear the EXAMPLE, delete the contents of the 'Row' column and of every yellow cell on Register, Controls and Reviews. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Rule PM-17: "Every system and product within [[12]] months of the end of vendor support, or past it, must be in the end-of-life register with its owner, end date and plan, and reviewed at least quarterly (P01 VM-15). Until it is retired, a system past support with no extended support needs isolation and tested compensating controls, a P02 exception and a retirement date; where the risk is outside appetite, the P05 approver signs as well."
Version upgrades: Planned [[6]] months before the running version's support ends, and in the end-of-life register from [[12]] months before (PM-17).
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Its register, built on 10 Sep 2026 and read as at 30 Sep 2026: NAS-W3 (past support); Weighbridge PC, Warehouse 1 (past normal support); FW-01 and FW-02 (support ends within 12 months).
Tailoring — small organisation: one row per product is enough (for example, one operating system version on 40 laptops). Keep the end dates, the retirement date and the quarterly review.
Tailoring — IT run by a managed service provider: ask the provider for the support end dates of everything it runs for you, every quarter, in writing. The decisions and the exception stay yours.
Tailoring — regulated financial entity: DORA asks for a yearly risk assessment of all legacy systems (Article 8(7)) and for the end dates of regular, extended and custom support to be recorded (Delegated Regulation (EU) 2024/1774, Article 4(2)(b)(ix)). Keep the yearly assessment with this register.
Summary
Summary
Every figure is calculated from the Register and Controls sheets at the As-at date. Report PCM-04 monthly to the security and IT leadership team (PM-19).
| As-at date | 30 Sep 2026 | EXAMPLE: the quarter end. Use the day you read the register. |
| Look-ahead (months before the end of support) | 12 | PM-17. A row enters the register this many months before support ends. |
| Review at least every (months) | 3 | Quarterly (P01 VM-15). |
| Warn when an exception expires within (days) | 30 | So it is renewed, or the system retired, in time. |
Rows by status
| Status | Rows |
|---|---|
| Past support: no security patches | 1 |
| Past normal support: on extended support | 1 |
| Support ends within 12 months | 1 |
| Supported | 0 |
| All rows | 3 |
PCM-04 Systems past vendor support
| Count | Rows | |
|---|---|---|
| Past support with no extended support | 1 | |
| Of which with an unexpired P02 exception and a retirement date | 1 | |
| PCM-04: of which with neither (the figure judged) | 0 | Target: none. A system past support always has an unexpired exception and a retirement date (PM-17). |
| Past normal support, on extended support | 1 | |
| Support ends within the look-ahead | 1 |
Needs attention
| Check | Rows |
|---|---|
| Rows whose PM-17 check is incomplete | 0 |
| Rows whose quarterly review is overdue | 0 |
| Exceptions expiring within the warning period | 0 |
| Retirement dates passed with the system still in the register | 0 |
| Compensating controls not yet tested, or failed | 0 |
Register
One row per system or product within 12 months of the end of vendor support, or past it (PM-17). Yellow columns are yours; status, review and the PM-17 check calculate at the As-at date on the Summary.
| Row | Register ID | System or product | What it is, and what it holds | Asset class | Owner | End of vendor support | Extended support paid to | Extended support notes | Months to end of support (calc; negative = past) | Status (calc) | Options considered (EO-1 to EO-6) | Isolated? | Isolation: segment and connections allowed | Compensating controls tested (calc) | Deferral reference | P02 exception reference | Exception expiry | Risk left outside appetite? (P05) | P05 approver signed on | Retirement date | Plan | Last reviewed | Next review due (calc) | Review (calc) | PM-17 check (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | EOL-01 | NAS-W3 | Document storage appliance at Warehouse 3 goods-in: scanned delivery notes, which carry customer names and addresses | AC-3 | Head of Logistics | 30 Jun 2024 | None offered by the vendor | -27 | Past support: no security patches | EO-1: still needed until the scans move. EO-2: replacement on 30 Nov 2026. EO-3: the vendor offers no extended support. EO-4 and EO-5 applied. | Yes | Moved to its own network segment, reachable only from the three goods-in PCs at Warehouse 3, with no internet access and its administration interface turned off | 2 | DEF-2026-02 | EX-2026-024 | 30 Nov 2026 | No | 30 Nov 2026 | Move the scans to a share on FS-02 and retire the appliance | 10 Sep 2026 | 10 Dec 2026 | Not yet due | Complete (PM-17) | ||
| EXAMPLE | EOL-02 | Weighbridge PC, Warehouse 1 | Desktop that runs the weighbridge software at goods-in; the software's current version supports only this operating system version | AC-1 | Head of Logistics | 14 Oct 2025 | 12 Oct 2027 | Paid extended security updates, bought a year at a time; the second year, to 12 Oct 2027, was bought on 22 Sep 2026 | -11 | Past normal support: on extended support | EO-1: still needed until the new weighbridge software is in. EO-2: replacement planned. EO-3: extended security updates bought, a year at a time. | N/A | 0 | N/A | 29 Jan 2027 | Replace with the weighbridge software's new version on a supported operating system | 10 Sep 2026 | 10 Dec 2026 | Not yet due | Extended support covers the time to retire | |||||
| EXAMPLE | EOL-03 | FW-01 and FW-02 | The internet-edge firewall pair | AC-3 | Head of IT | 31 Mar 2027 | Not needed if replaced on time | 6 | Support ends within 12 months | EO-2: replacement planned and budgeted before support ends. | N/A | 0 | N/A | 26 Feb 2027 | Replace the pair before support ends; budget approved in the 2027 plan | 10 Sep 2026 | 10 Dec 2026 | Not yet due | Retired before support ends |
Controls
Each isolation or compensating control on a row of the Register, and when it was last tested. A control counts only once it has been tested (P02 EX-07). Retest it at each quarterly review.
| Row | Register ID | Compensating control: what it does | Option | Tested on | Tested by | Test result | Retest due (calc) | Status (calc) |
|---|---|---|---|---|---|---|---|---|
| EXAMPLE | EOL-01 | Moved to its own network segment, reachable only from the three goods-in PCs at Warehouse 3, with no internet access and its administration interface turned off | EO-4 | 14 Sep 2026 | IT Operations Manager | Pass | 14 Dec 2026 | Tested |
| EXAMPLE | EOL-01 | One administrator account left, and the appliance's access log sent to the security monitoring provider (P06 SUP-006), which alerts on any sign-in or connection from anywhere but the goods-in PCs | EO-5 | 15 Sep 2026 | IT Operations Manager | Pass | 15 Dec 2026 | Tested |
Reviews
Each review of the whole register: at least once a quarter (P01 VM-15), and whenever a vendor announces a new end-of-support date.
| Row | Review date | Reviewed by | Rows reviewed | What changed, and what was decided | Next review due (calc) |
|---|---|---|---|---|---|
| EXAMPLE | 10 Sep 2026 | IT Operations Manager | 3 | Register built from the asset inventory and the vendors' support dates. NAS-W3 found past support since 30 Jun 2024: isolated, and deferral DEF-2026-02 requested on 14 Sep 2026. The weighbridge PC's extended support to be renewed before 13 Oct 2026. The firewall pair's replacement confirmed in the 2027 plan. | 10 Dec 2026 |
Options
What to do about a system past support, in order
Work through the options in order for every row (PM-17). Upgrading or replacing is the only lasting answer; the others buy time and need a date.
| ID | Option | What it means |
|---|---|---|
| EO-1 | Still needed? | Ask the owner. If the system is no longer needed, retire it now. |
| EO-2 | Upgrade or replace | Move to a supported version or product. This is the only lasting answer. |
| EO-3 | Extended support | Buy the vendor's extended security updates where they are offered, for the time it takes to replace the system. The system stays in the register. |
| EO-4 | Isolate | Its own network segment, only the connections it needs, no internet, no email or browsing, and its administration interfaces off. |
| EO-5 | Compensating controls | Application allow-listing, closer monitoring, checked backups and the fewest accounts possible, each tested. |
| EO-6 | Record and decide | A P02 exception with its expiry, a retirement date, a quarterly review (P01 VM-15), and the P05 approver's signature as well where the risk is outside appetite. |
How long an exception can run
| Band | Approved by | Longest expiry (days) |
|---|---|---|
| Low | Control owner | 90 |
| Medium | Head of Information Security | 90 |
| High | Head of Information Security and the accountable executive (risk owner) | 90 |
| Critical | The board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management | 30 |
The band comes from the P02 score. The longest expiry is the band's maximum or P01's 90 days, whichever is shorter (PM-14). Renew before expiry, or retire the system.
What each status means
| Status | Meaning | |
|---|---|---|
| Past support: no security patches | Support has ended and no extended support is paid for. Isolation, a tested compensating control, an unexpired P02 exception and a retirement date are all needed (PM-17). | |
| Past normal support: on extended support | Normal support has ended; the vendor still releases security patches because extended support is paid for. Patch it as normal. A system on extended support is still recorded in the end-of-life register. | |
| Support ends within 12 months | Support ends within the look-ahead of 12 months. Plan the upgrade or replacement now (PM-18). | |
| Supported | Support ends after the look-ahead. Keep the row only if it is useful to watch. | |
Lists
| AssetClassID | AssetClass | OptionID | YesNoNA | PassFail |
|---|---|---|---|---|
| AC-1 | End-user devices | EO-1 | Yes | Pass |
| AC-2 | Servers | EO-2 | No | Fail |
| AC-3 | Network and security appliances | EO-3 | N/A | |
| AC-4 | Business applications | EO-4 | ||
| AC-5 | Cloud and software services the provider patches | EO-5 |
EO-6
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| End of support | The date after which the vendor no longer releases security patches for a product or version. |
| Extended support | Security patches the vendor still releases, usually for a fee, for a limited time after the end of normal support. A system on extended support is still recorded in the end-of-life register. |
| Compensating control | A measure that makes a vulnerability harder to exploit while the patch is not installed: blocking the vulnerable service, restricting who can reach the system, disabling the affected feature or isolating the system. It counts only once it has been tested (P02 EX-07). |
| Isolation | Its own network segment, only the connections it needs, no internet, no email or browsing, and its administration interfaces off. |
| Retirement date | The date the system is switched off or replaced, set by its owner. A system still in use after it is past support without an exception breaks PM-17. |
| P02 exception | The exception, in the exception and waiver pack's register, that accepts the risk of running the system past support until its expiry. Requested with the Patch Deferral Request Form. |
| Outside appetite | The risk left after the controls is outside the appetite the risk management pack (P05) sets for its category. The P05 approver then signs as well: the stricter of the two always applies. |
| Months to end of support | Whole calendar months from the As-at date to the end of support; negative once support has ended. |
| AC-1 End-user devices | Laptops, desktops and tablets: their operating system, office software, browsers, document readers and other installed applications. |
| AC-2 Servers | Server operating systems, databases and server applications, on premises and in the organisation's own cloud subscriptions. |
| AC-3 Network and security appliances | Firewalls, remote access gateways, switches, wireless controllers and storage appliances. |
| AC-4 Business applications | Line-of-business applications, web applications and the components and libraries they are built on. |
| AC-5 Cloud and software services the provider patches | Software as a service, and hosting where the provider patches the platform beneath what the organisation runs. |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| PM-nn, EO-n, VM-nn, EX-nn | Rules of the Patch Management Standard, the options on the Options sheet, and the rules of the vulnerability management (P01) and exception (P02) packs. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Delete before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 8.8 — Management of technical vulnerabilities | Systems no longer patched: the vulnerability handled by isolation, compensating controls and retirement |
| ISO/IEC 27001:2022 | Annex A 5.9 — Inventory of information and other associated assets | The register as part of the asset inventory: each system's owner, support dates and plan |
| NIST CSF 2.0 | ID.AM-08 — “Systems, hardware, software, services, and data are managed throughout their life cycles” | Status, plan and retirement date: systems managed through their life cycle to retirement |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Who the Implementing Regulation binds: the digital providers its Article 1 names. For others it shows what a regulator expects |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 6.6.1 — “The relevant entities shall specify and apply procedures, coherent with the change management procedures referred to in point 6.4.1 as well as with vulnerability management, risk management and other relevant management procedures, for ensuring that: (a) security patches are applied within a reasonable time after they become available; (b) security patches are tested before being applied in production systems; (c) security patches come from trusted sources and are checked for integrity; (d) additional measures are implemented and residual risks are accepted in cases where a patch is not available or not applied pursuant to point 6.6.2.” | Systems with no patch available: isolation and compensating controls in place, and the residual risk accepted through a P02 exception |
| DORA — Regulation (EU) 2022/2554 | Article 8(7) — “Financial entities, other than microenterprises, shall on a regular basis, and at least yearly, conduct a specific ICT risk assessment on all legacy ICT systems and, in any case before and after connecting technologies, applications or systems.” | Register and Reviews: legacy systems listed and their risk assessed on a regular basis (financial entities) |
| DORA — Delegated Regulation (EU) 2024/1774 | Article 4(2)(b)(ix) — records of “where applicable, for all ICT assets, the end dates of the ICT third-party service provider’s regular, extended, and custom support services after which those ICT assets are no longer supported by their supplier or by an ICT third-party service provider” | End of vendor support and extended support paid to: the end dates of regular and extended support recorded (financial entities) |
| DORA — Delegated Regulation (EU) 2024/1774 | Article 8(2)(a)(iii) — “requirements regarding the identification and control of legacy ICT systems” | The register as a whole: legacy systems identified and controlled (financial entities) |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA) and Delegated Regulation (EU) 2024/1774
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.