GOV-14 Govern
Legacy system management
Systems (infrastructure, operating systems, applications and data) that are not capable of meeting cyber security requirements are managed using compensating security controls, along with enhanced monitoring and assurance activities, to maintain an acceptable level of residual risk until they can be decommissioned or replaced.
Enterprise IT actions
-
IT.GOV-14.1
Establish and maintain a process for identifying, assessing and treating cyber security risks associated with legacy systems and unsupported technologies through compensating controls, enhanced monitoring and assurance until the systems can be removed or replaced.
- Every phaseGovernance and culture
ASD’s indicators
Not effective
- No documented or approved governance process exists for identifying or managing legacy systems.
- Legacy systems are not formally identified within the environment.
- Cyber security risks associated with legacy systems are not assessed or are assessed informally.
- There are no interim compensating controls to manage identified cyber security risks associated with legacy systems.
- Legacy systems remain in operation indefinitely with no documented decommissioning, replacement or migration path.
Partially effective
- A process exists but the criteria for classifying a system as legacy are not documented or are inconsistently applied.
- Some legacy systems are identified but the inventory is incomplete or is not maintained.
- Risk assessments are conducted for some legacy systems but treatment decisions are not documented or approved.
- Some compensating controls are in place to address risks associated with legacy systems, but coverage is not complete.
- A path exists for some legacy systems but is not tracked to completion.
Fully effective
- A documented and approved governance process exists with clear criteria for classifying systems as legacy.
- Legacy systems are formally identified, inventoried and reviewed on a cycle defined by the organisation.
- Cyber security risks associated with legacy systems are assessed, treated and approved by an appropriate authority.
- Compensating controls are applied to manage cyber security risks for legacy systems while decommissioning or migration efforts are in progress.
- A documented decommissioning, replacement or migration path exists for retained legacy systems and is tracked to completion.
Rate this action in the NavigatorRelated frameworks
- ISM
- ISM-1203, ISM-1526, ISM-1809
- NIST CSF 2.0
- GV.RM-06, ID.AM-08, ID.RA-01
- NIST SP 800-171r3
- 03.16.02, 03.11.01, 03.11.04, 03.12.02
- AESCSF v2
- THIRD-PARTIES-2i, RISK-2a, ASSET-1h, ARCHITECTURE-3l
- Essential Eight
- Patch operating systems
Operational technology actions
-
Action 1
Establish and maintain a process for identifying, assessing and managing the cyber security risk associated with legacy and unsupported systems that remain operationally critical, until they can be removed or replaced.
- Every phaseGovernance and culture
Cloud actions
-
Action 1
Establish and maintain a process for identifying, assessing and treating cyber security risks associated with legacy systems and unsupported technologies through compensating controls, enhanced monitoring and assurance until the systems can be removed or replaced.
- Every phaseGovernance and culture
- ResponsibilityPaaS: Customer, SaaS: Customer
More Govern principles
- GOV-01Executive cyber security accountability
- GOV-03Security risk management assurance
- GOV-04Cyber security resourcing
- GOV-07Continuous cyber security improvement
- GOV-08Executive artificial intelligence accountability
- GOV-09Security risk management responsibilities
- GOV-10System exposure minimisation
- GOV-11Supplier cyber security assurance
Source: ASD Essentials for enterprise IT, version 2026.10.15; ASD Essentials for operational technology, version 2026.10.15; ASD Essentials for cloud, version 2026.10.15, Australian Signals Directorate. The Navigator is an independent project and is not affiliated with or endorsed by the Australian Signals Directorate.