Ensure Authorized Software is Currently Supported
Description
Ensure that only currently supported software is designated as authorized in the software inventory for enterprise assets. If software is unsupported, yet necessary for the fulfillment of the enterprise’s mission, document an exception detailing mitigating controls and residual risk acceptance. For any unsupported software without an exception documentation, designate as unauthorized. Review the software list to verify software support at least monthly, or more frequently.
Implementation Checklist
Tool Recommendations
Unified endpoint management platform for device enrollment, software deployment, configuration, and compliance across Windows, macOS, iOS, and Android
Microsoft · Per-user/per-device subscription
Digital workspace platform combining UEM with virtual app delivery and zero-trust access for endpoint management
Broadcom (VMware) · Per-device subscription
IT asset management and software asset management platform with license optimization and SaaS management
Flexera · Enterprise subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Exploitation of End-of-Life Software Vulnerabilities
IntegrityUnsupported software no longer receives security patches, allowing attackers to exploit publicly disclosed CVEs with readily available exploit code.
Zero-Day Persistence in Legacy Applications
ConfidentialityUnsupported applications with zero-day vulnerabilities will never be patched by the vendor, giving attackers permanent exploitation capabilities against those systems.
Vulnerabilities (When Safeguard Absent)
Unsupported Software in Production Without Mitigating Controls
Running end-of-life software without documented exceptions and compensating controls leaves known vulnerabilities permanently unaddressed in the environment.
No Tracking of Software Support Lifecycle
Without monitoring vendor support status, the organization is unaware when critical software transitions to end-of-life, continuing to rely on it without risk acceptance.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Document | Current inventory or catalog documentation | Maintained continuously, reviewed quarterly |
| Document | Process/procedure documentation for identification activities | Reviewed annually |
| Technical | Asset/software inventory export with required fields populated | Exported quarterly for review |
| Record | Inventory review meeting minutes or sign-off | Per review cycle |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |