Start: EOL Assets

Requiring Exception or

Decommissioning

Identify Already EOL Assets

Scan inventory, Prioritize

critical, Flag overdue EOL

Risk Assessment

Assess impacts/risks/compliance

Classify and escalate high risks

Decision: Retain with Exception?

Yes: Business justification

strong,\nRisks mitigable

Exception Process

Submit urgent request: Risk

assessment, Mitigation plan &

(isolate/controls/support),

Justification, Short-term approval

Approval and Monitoring

Approve by Senior Mgmt,\nLog/review monthly,\nMonitor KRs,\nForce decom if breach/vuln

Documentation

Log actions/decisions,\nTrack tickets urgently,\nRetain audit records

End

No: Risks too high,\nReplacement/decom required

Decommission Process

For Hardware: Secure removal,\nData wipe per NIST 800-88,\nCompliant disposal\nFor Software: Migrate/remove