The institution avoids outdated or unsupported systems by tracking lifespans, warranties and support contracts and notifying staff of end-of-support dates, deciding to update, replace or decommission on age, performance, business alignment and condition; where no alternative exists or refresh is riskier than retention, a thorough risk evaluation and the risk acceptance process authorise continued use. Staff are trained on new or updated systems and migrated data is handled safely. An asset decommissioning strategy includes a risk assessment per system, states what is reused, recycled or destroyed and how, and documents all activities for regulatory and investigative purposes; third parties used for decommissioning are risk-assessed; data on decommissioned systems is fully wiped with a documented chain of custody validating who performed the wipe; and the strategy covers intangible assets such as domains, subscriptions, cloud instances and external network connections and leased assets such as printers and terminals so that corporate data is promptly deleted or rendered unusable.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.