Australian Information Security Manual
Guidelines for system management

Australian Information Security Manual ISM-1809: Compensating controls for unsupported systems

When applications, operating systems, network devices or networked IT equipment that are no longer supported by vendors cannot be immediately removed or replaced, compensating controls are implemented until such time that they can be removed or replaced.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 5 controls across 5 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

CIS Controls v8 · 1 control

  • CIS-2.2 Ensure Authorized Software is Currently Supported

ISO 27002:2022 · 1 control

  • 8.8 Management of technical vulnerabilities

NIST Cybersecurity Framework 2.0 · 1 control

  • NIST-CSF-ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated

New Zealand Information Security Manual (NZISM) · 1 control

  • 18.4.14.C.01 18.4.14.C.01 Block unwanted active content and restrict to trusted sources

Protective Security Policy Framework (PSPF) Release 2026 · 1 control

  • 0093 0093 Apply ASD temporary mitigations to legacy IT

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Guidelines for system management

Query this from an agent

The graph holds this control, the 5 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Australian Information Security Manual controls