3.4. Asset Retention and EOL
💡 First Principle: Every technology asset will eventually become unsupported — the vendor will stop issuing patches, the operating system will reach end of life, the hardware will fail without available replacements. The security team's job is to track these lifecycle events before they happen and ensure the organization is not operating on unsupported systems without a deliberate, documented risk decision.
Running unsupported systems is not inherently wrong — it may be a deliberate business decision with appropriate compensating controls. What is wrong is running them without awareness, without risk assessment, and without compensating controls. The difference between managed risk and negligence is documentation and decision-making authority.
Why this matters: EOL/EOS scenarios appear as "which is the FIRST thing to do?" questions. The answer is never "immediately replace the system" — it's "assess the risk, inform management, and implement compensating controls while a migration plan is developed."
⚠️ Common Misconception: "EOL and EOS mean the same thing." They don't. End of Life (EOL) means the vendor will no longer sell the product. End of Support (EOS) means the vendor will no longer provide security patches or technical support. A product can be EOL but still in support. The security risk is EOS — when patches stop, vulnerability accumulation begins.
